Path Traversal in pH7Builder CMS via deletePhoto()

Executive Summary

This vulnerability is a path traversal issue in pH7Builder (pH7 Social Dating CMS) versions before 18.5.0. It allows authenticated members to delete arbitrary files by supplying ../ sequences in the picture_link parameter during the deletePhoto() action in the picture module. This can lead to unauthorized file deletion, content loss, and denial of service.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized file deletions in pH7Builder installations before version 18.5.0. Inspect web server logs for POST requests to the picture module's deletePhoto() action with ../ sequences in the picture_link parameter. Look for missing files or unusual cache/configuration deletions.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow attackers to delete other users' photos, configuration files, or cache files. This may result in data loss, system instability, or denial of service for the application. Attackers need authenticated access but can manipulate file paths to remove critical files outside intended directories.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized data deletion or exposure. GDPR requires protecting personal data integrity, while HIPAA mandates safeguarding health information. Unauthorized file deletion may violate these regulations, potentially resulting in legal penalties or data breach notifications.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade pH7Builder to version 18.5.0 or later immediately. If upgrading is not possible, apply the patch from the GitHub commit 2ffa19ac36d58dbaac37e1c4912be469d67ee75c manually. Ensure input validation is enforced in all file deletion functions.

Useful 0 Not Useful 0