Path Traversal Vulnerability in pH7Builder

pH7 Social Dating CMS (pH7Builder) versions prior to 18.5.0 contain a critical path traversal vulnerability within the deletePhoto() action of the picture module. An authenticated member can manipulate the picture_link parameter during a file deletion request by injecting directory traversal sequences (such as ../). This flaw allows the attacker to escape the intended directory and delete arbitrary files accessible by the web server process. Successful exploitation can lead to the deletion of configuration files, cache files, or other users' media, resulting in persistent denial of service or disruption of application functionality. Organizations using this CMS should prioritize patching to version 18.5.0 or later to mitigate the risk of unauthorized file deletion and system instability.

Impact

The vulnerability allows for arbitrary file deletion on the hosting server. This impact is significant for a Content Management System, as attackers can delete critical application configuration files or site content, resulting in immediate service disruption. No specific number of victims is provided, but all internet-facing instances of pH7Builder below version 18.5.0 are currently at risk of exploitation.

Recommendation

• Upgrade pH7 Social Dating CMS to version 18.5.0 or later immediately.
• Implement strict input validation on the picture_link parameter within the picture module to prevent path traversal sequences.
• Restrict file system permissions for the web server user to the minimum necessary directories to limit the scope of potential file deletions.
• Audit web server access logs for POST requests to the picture module containing directory traversal characters (e.g., "../" or "..\").