Cross-Site Request Forgery in Twitter-Clone 1 Allows Post Deletion

Publication date: 2026-05-25

Last updated on: 2026-05-25

Assigner: VulnCheck

Description

Twitter-Clone 1 contains a cross-site request forgery vulnerability that allows remote attackers to force victims to delete posts by crafting malicious HTML forms. Attackers can create hidden forms targeting tweetdel.php with tweet IDs and automatically submit them to delete arbitrary posts from authenticated user sessions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-25

Last Modified

2026-05-25

Generated

2026-07-06

AI Q&A

2026-05-26

EPSS Evaluated

2026-07-04

NVD

CVE-2018-25363

EUVD

EUVD-2018-21887

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Twitter-Clone 1 and is a cross-site request forgery (CSRF) issue. It allows remote attackers to trick authenticated users into unknowingly deleting their own posts. Attackers do this by creating malicious HTML forms that target the tweet deletion endpoint (tweetdel.php) with specific tweet IDs. When these forms are automatically submitted by the victim's browser, arbitrary posts can be deleted without the user's consent.

Impact Analysis

The impact of this vulnerability is that an attacker can delete posts from an authenticated user's account without their knowledge or permission. This can lead to loss of important content, disruption of communication, and potential damage to the user's reputation or data integrity on the platform.

Hi! I’m here to help you understand CVE-2018-25363. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70