pH7Builder versions prior to 18.6.0 contain a hard-coded API key vulnerability in Tool.class.php. This flaw allows unauthenticated attackers to bypass API access controls by spoofing the Host header and using a default private API key. Exploitation can lead to unauthorized retrieval of sensitive member information including emails, IP addresses, phone numbers, and bank account details.
pH7Builder versions before 18.5.0 have an information disclosure vulnerability where API endpoints return unfiltered user data. Attackers with a valid private API key can access sensitive information including bcrypt password hashes, non-expiring reset tokens, and TOTP secrets, enabling account takeover and bypass of two-factor authentication.
pH7Builder versions before 19.3.0 contain a CAPTCHA bypass vulnerability that allows unauthenticated attackers to bypass form validation by manipulating form IDs. This enables attackers to submit forms such as contact, comment, forum, invite, or signup without completing CAPTCHA verification, potentially automating abuse.
pH7Builder versions prior to 18.5.0 contain a path traversal vulnerability in the picture module's deletePhoto() action. Authenticated users can exploit this flaw by supplying '../' sequences in the picture_link parameter to delete arbitrary files, including other users' photos and configuration or cache files. This can lead to content loss and denial of service.
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verification codes to VerificationCodeFormProcess.php to take over member, affiliate, or administrator accounts.
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper authorization vulnerability in the note module delete() action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remove all comments and category associations, since those queries lack profile ID checks.
pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membership tier by supplying client-controlled plan and amount fields. Attackers can set item_number, cart_order_id, or the PayPal custom field while paying a token amount, or submit uncompleted PayPal IPN payments, to gain the most expensive membership and its paid features.
pH7Software pH7Builder (pH7 Social Dating CMS) up to version 18.2.0 does not verify that the client IP address resolved from HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers originates from a trusted proxy. This allows a remote unauthenticated attacker to bypass IP-based throttling on the admin login by sending varying X-Forwarded-For values, effectively circumventing login attempt limits.
Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder (pH7 Social Dating CMS) through 19.2.0. The CAPTCHA escalation flag is stored in the PHP session as captcha_admin_enabled and the CAPTCHA form element is only built when that flag is present, so a remote unauthenticated attacker who obtains a new session before each login attempt is never presented with the challenge.