CVE-2018-25080 json
MobileDetect Example session_example.php initLayoutType cross site scripting
published 2023-02-04 3 y ago modified 2026-06-17 4 mo ago also GHSA-r77c-qv68-j3pp , EUVD-2023-0788
- cvss
- 3.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.7%
- EPSS 2.7% chance of exploitation in 30 days, percentile 85%
- public exploits
- 1
- Exploit-DB
Summary
A vulnerability, which was classified as problematic, has been found in MobileDetect 2.8.31. This issue affects the function initLayoutType of the file examples/session_example.php of the component Example. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.8.32 is able to address this issue. The identifier of the patch is 31818a441b095bdc4838602dbb17b8377d1e5cce. It is recommended to upgrade the affected component. The identifier VDB-220061 was assigned to this vulnerability.
Patch / fix
- packagist mobiledetect/mobiledetectlib 2.8.32
Timeline
- Published
- First public exploit (EDB-52454)
Exploit prediction
2.66% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-52454 MobileDetect 2.8.31 - Cross-Site Scripting (XSS) webapps, 2025-12-03
- github.com https://github.com/serbanghita/Mobile-Detect/pull/741 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N |
| CNA | 3.0 | 3.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N |
| CNA | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:N/I:P/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | mobiledetect/mobiledetectlib | <2.8.32 |
2.8.32 |
Affected products
- n/a MobileDetect
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/serbanghita/Mobile-Detect/pull/741
exploit, issue-tracking, web, patch
-
github.com
/serbanghita/Mobile-Detect/commit/31818a441b095bdc4838602dbb17b8377d1e5cce
patch, web
-
github.com
/serbanghita/Mobile-Detect/releases/tag/2.8.32
patch, web, release-notes
-
vuldb.com
/?id.220061
vdb-entry, technical-description, web, permissions-required, third-party-advisory
-
vuldb.com
/?ctiid.220061
signature, permissions-required, web, third-party-advisory
-
github.com
/MarkLee131/awesome-web-pocs/blob/main/CVE-2018-25080.md
web
-
nvd.nist.gov
/vuln/detail/CVE-2018-25080
advisory
-
github.com
/serbanghita/Mobile-Detect
package
Sources
- CVE List CVE-2018-25080
- GitHub Advisory GHSA-r77c-qv68-j3pp
- NVD CVE-2018-25080
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.