CyberRota Analysis
AI-GeneratedThe Veno File Manager Project version 4.4.9 is vulnerable due to incorrect access control in the /vfm-admin/ajax/sendfiles.php endpoint, allowing unauthenticated attackers to exploit this flaw and send emails through the configured SMTP server by crafting a specific POST request. This could lead to unauthorized email dissemination, potentially facilitating phishing attacks or spam campaigns. Organizations using this file manager should prioritize remediation to mitigate the risk of abuse and protect their email infrastructure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMPT server on the application via making a POST request to the endpoint with needed parameters and header.