Atjiu pybbs Stored Cross-Site Scripting Vulnerability in Comments API

A stored cross-site scripting vulnerability has been identified in atjiu pybbs version 6.0.0. This issue arises in the 'create' function of the 'CommentApiController.java' file, when the application is set to 'RICH' content mode. In this mode, user-submitted HTML is directly saved to the database and displayed on the frontend without proper sanitization. This allows authenticated attackers to inject malicious JavaScript that executes when other users view the comment.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the comments.