CVE-2018-25308: BuddyPress Xprofile Custom Fields Type 2.6.3 Arbitrary File Deletion
BuddyPress Xprofile Custom Fields Type 2.6.3 contains a remote code execution vulnerability that allows authenticated users to delete arbitrary files by manipulating unescaped POST parameters. Attackers can modify the fieldhiddenfile and fielddeleteimg parameters during profile editing to unlink files from the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-25308?
The severity of CVE-2018-25308 is considered critical due to its potential for remote code execution.
How do I fix CVE-2018-25308?
To fix CVE-2018-25308, upgrade BuddyPress Xprofile Custom Fields Type to version 2.6.4 or later where the vulnerability is patched.
What are the potential impacts of CVE-2018-25308?
The potential impacts of CVE-2018-25308 include unauthorized file deletion and exploitation of the application by authenticated users.
Who is affected by CVE-2018-25308?
CVE-2018-25308 affects users of BuddyPress Xprofile Custom Fields Type version 2.6.3.
Is authentication required to exploit CVE-2018-25308?
Yes, authentication is required to exploit CVE-2018-25308 as it targets authenticated users.