CVE-2009-0487

Vulnerability

Mahara versions prior to 1.0.9 contain a stored cross-site scripting (XSS) vulnerability in forum posts. The application does not filter HTML or script content submitted via forum posts, allowing injection of arbitrary web script or HTML. The vulnerability affects all deployments using the forum feature before upgrading to version 1.0.9 [2].

Exploitation

A remote attacker can exploit this vulnerability by posting a crafted forum message containing malicious HTML or JavaScript. No authentication or special privileges are required beyond access to the forum feature; any user who can create or reply to a forum topic can inject the payload [1]. The malicious script triggers when other users (including administrators) view the affected post.

Impact

Successful exploitation leads to arbitrary script execution in the context of the victim's browser. This can result in information disclosure (e.g., session cookies, page content), session hijacking, or defacement of the site for other users. The impact is limited to the victim's session and does not directly compromise the server [2].

Mitigation

Upgrade to Mahara version 1.0.9 (released January 28, 2009) which applies HTMLPurifier to filter all forum posts before rendering [2]. No other workaround is documented in the available references. The vulnerable versions are all releases before 1.0.9.