Vvveb Stored Cross-Site Scripting Vulnerability in Signup Flow

A stored cross-site scripting vulnerability has been identified in Vvveb versions prior to 1.0.8.3. The issue arises in the customer signup process, where the Signup::addUser() controller transfers raw POST username values into the display_name field without proper sanitization. This allows attackers to inject HTML and script elements into the username field during registration. While the username column removes this markup, the display_name column retains it unchanged. Consequently, when display_name is displayed in vulnerable views without appropriate encoding, the injected scripts are executed, leading to stored cross-site scripting.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected content.

Remediation

Users can update to Vvveb version 1.0.8.3 or later, where this vulnerability has been addressed.