CVE-2018-25248 — HIGH (7.2)

Vulnerability Description

MyBB Downloads Plugin 2.0.3 contains a persistent cross-site scripting vulnerability that allows regular members to inject malicious scripts through the download title field. Attackers can submit a new download with HTML/JavaScript code in the title parameter, which executes when administrators validate the download in downloads.php.

CVSS Score

7.2

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Mybb	Mybb Downloads	2.0.3

Related Weaknesses (CWE)

CWE-79

References

https://community.mybb.com/mods.php?action=view&pid=854Permissions RequiredProduct
https://www.exploit-db.com/exploits/44400ExploitVDB Entry
https://www.vulncheck.com/advisories/mybb-downloads-plugin-persistent-xss-via-doThird Party Advisory

FAQ

What is CVE-2018-25248?

CVE-2018-25248 is a vulnerability with a CVSS score of 7.2 (HIGH). MyBB Downloads Plugin 2.0.3 contains a persistent cross-site scripting vulnerability that allows regular members to inject malicious scripts through the download title field. Attackers can submit a ne...

How severe is CVE-2018-25248?

CVE-2018-25248 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-25248?

Check the references section above for vendor advisories and patch information. Affected products include: Mybb Mybb Downloads.