Plattform
php
Komponente
mybb-downloads
Behoben in
2.0.4
CVE-2018-25248 describes a persistent cross-site scripting (XSS) vulnerability discovered in the MyBB Downloads Plugin. This flaw allows regular members of a MyBB forum to inject malicious scripts into the download title field, potentially leading to session hijacking, defacement, or redirection. The vulnerability impacts versions 2.0.3–2.0.3 of the plugin, and a fix is available in version 2.0.4.
An attacker can exploit this XSS vulnerability by crafting a malicious download with JavaScript code embedded in the title field. When an administrator validates this download through the downloads.php page, the script executes in the administrator's browser context. This allows the attacker to steal the administrator's session cookie, potentially gaining full control over the forum. The impact extends beyond simple defacement; an attacker could inject malware, redirect users to phishing sites, or modify forum content. The blast radius is limited to users who interact with the affected downloads page, particularly administrators.
CVE-2018-25248 was publicly disclosed on 2026-04-04. While no active exploitation campaigns have been definitively linked to this specific vulnerability, XSS vulnerabilities are frequently targeted by attackers. No public proof-of-concept (PoC) code has been widely distributed, but the ease of exploitation makes it a potential target. It is not listed on the CISA KEV catalog.
MyBB forum administrators are at the highest risk, as they are the ones who validate downloads and are therefore exposed to the malicious script execution. Regular forum members are also at risk if they click on a malicious download link, although the impact is generally limited to their own browser session.
• php: Examine the downloads.php file for instances where the download title is echoed without proper sanitization. Search for patterns like <script> or javascript: within the title parameter in access logs.
grep -r 'javascript:' /path/to/mybb/downloads.php• generic web: Monitor access logs for requests to downloads.php with unusual or lengthy title parameters. Check response headers for signs of script execution.
curl -I https://example.com/downloads.php?title=<script>alert('XSS')</script>disclosure
Exploit-Status
EPSS
0.03% (8% Perzentil)
CISA SSVC
CVSS-Vektor
The primary mitigation for CVE-2018-25248 is to upgrade the MyBB Downloads Plugin to version 2.0.4 or later. If upgrading is not immediately feasible, administrators should carefully review all newly submitted downloads before validation, paying close attention to the title field for suspicious characters or code. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide an additional layer of defense. Regular security audits of the MyBB forum and its plugins are also recommended to identify and address potential vulnerabilities.
Actualice el plugin MyBB Downloads a la versión 2.0.4 o posterior para mitigar la vulnerabilidad XSS. Esta actualización corrige la forma en que se manejan los títulos de descarga, evitando la inyección de código malicioso.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2018-25248 is a cross-site scripting (XSS) vulnerability in MyBB Downloads Plugin versions 2.0.3–2.0.3, allowing attackers to inject malicious scripts through the download title field.
You are affected if you are running MyBB Downloads Plugin version 2.0.3–2.0.3. Upgrade to version 2.0.4 or later to mitigate the risk.
Upgrade the MyBB Downloads Plugin to version 2.0.4 or later. As a temporary workaround, carefully review all new downloads before validation.
While no active campaigns have been definitively linked, XSS vulnerabilities are frequently targeted, making this a potential risk.
Refer to the official MyBB security advisory for detailed information and updates regarding CVE-2018-25248.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.