Hustoj Cross-Site Scripting Vulnerability in thread.php

A cross-site scripting (XSS) vulnerability has been identified in Hustoj version 2025-01-31. The issue arises in the thread.php file, specifically through the TID parameter. An attacker can inject a malicious payload, which is then executed in the context of the user's browser when the thread is accessed.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, an attacker can create a new post using the newpost.php endpoint, injecting an XSS payload into the title field. Once the post is created, the payload will be executed when a user visits the corresponding thread in thread.php.

Remediation

Users are advised to sanitize the title input using htmlspecialchars() to prevent XSS payloads from being executed.