Ph7Builder
Monthly
Two-factor authentication bypass in pH7Builder (pH7 Social Dating CMS) before 18.5.0 lets attackers who already know a valid account password brute-force the 6-digit TOTP code submitted to VerificationCodeFormProcess.php without any attempt throttling, ultimately taking over member, affiliate, or administrator accounts. Exploitation is second-order: it requires prior credential compromise (PR:L) plus 2FA enabled on the target account, and success depends on racing the OTP rotation window (AT:P), but when those conditions hold nothing stops unlimited guesses. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor has shipped a fix in version 18.5.0 that reuses the existing per-IP login-attempt lockout.
An authenticated low-privileged member of a pH7Builder (pH7 Social Dating CMS) site running a version before 18.5.1 can upgrade themselves to the most expensive paid membership tier without paying the corresponding price. The payment controller trusts client-supplied plan and amount parameters - specifically item_number, cart_order_id, and the PayPal 'custom' field - so an attacker can pay a token amount (or submit an uncompleted PayPal IPN notification) and still be granted the highest tier and all of its paid features. The flaw requires a valid member account (CVSS 4.0 PR:L) and an instance that actually sells paid tiers through an enabled gateway, notably PayPal; no public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a fix in 18.5.1.
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper authorization (IDOR) flaw in the note module's delete() action that lets any authenticated member delete note comments and category associations belonging to other members by submitting the victim's note ID in the POST 'id' parameter. The impact is integrity-only and scoped to note-module comment/category data (CVSS 3.1 base 5.3, PR:L), not full account or site compromise. No public exploit has been identified at time of analysis, CISA SSVC rates exploitation as 'none', and the vendor patched the issue in 18.5.0.
Two-factor authentication bypass in pH7Builder (pH7 Social Dating CMS) before 18.5.0 lets attackers who already know a valid account password brute-force the 6-digit TOTP code submitted to VerificationCodeFormProcess.php without any attempt throttling, ultimately taking over member, affiliate, or administrator accounts. Exploitation is second-order: it requires prior credential compromise (PR:L) plus 2FA enabled on the target account, and success depends on racing the OTP rotation window (AT:P), but when those conditions hold nothing stops unlimited guesses. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor has shipped a fix in version 18.5.0 that reuses the existing per-IP login-attempt lockout.
An authenticated low-privileged member of a pH7Builder (pH7 Social Dating CMS) site running a version before 18.5.1 can upgrade themselves to the most expensive paid membership tier without paying the corresponding price. The payment controller trusts client-supplied plan and amount parameters - specifically item_number, cart_order_id, and the PayPal 'custom' field - so an attacker can pay a token amount (or submit an uncompleted PayPal IPN notification) and still be granted the highest tier and all of its paid features. The flaw requires a valid member account (CVSS 4.0 PR:L) and an instance that actually sells paid tiers through an enabled gateway, notably PayPal; no public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a fix in 18.5.1.
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper authorization (IDOR) flaw in the note module's delete() action that lets any authenticated member delete note comments and category associations belonging to other members by submitting the victim's note ID in the POST 'id' parameter. The impact is integrity-only and scoped to note-module comment/category data (CVSS 3.1 base 5.3, PR:L), not full account or site compromise. No public exploit has been identified at time of analysis, CISA SSVC rates exploitation as 'none', and the vendor patched the issue in 18.5.0.