Wikidforum Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in Wikidforum version 2.20. This issue allows authenticated users to inject malicious scripts by submitting crafted HTML through the reply_text parameter. The injected JavaScript executes in the browsers of users viewing the affected forum replies, potentially leading to session hijacking or other malicious actions.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, an authenticated user can post a comment on the forum using the rpc.php endpoint. The reply_text parameter should be filled with HTML that includes JavaScript, such as an image tag with an onerror event. Once the comment is posted, the injected script will execute in the browsers of users viewing the reply.