CVE-2018-25384

Vulnerability

Wikidforum version 2.20 contains a stored cross-site scripting (XSS) vulnerability in the reply_text parameter [2][4]. The application fails to properly sanitize user-supplied input when submitting forum replies via the rpc.php endpoint. An attacker can post crafted HTML containing JavaScript code, which is then stored and displayed to other users viewing the reply. The vulnerability affects Wikidforum version 2.20 (the latest at the time of disclosure) [3].

Exploitation

An attacker must be authenticated to the Wikidforum application [1][3]. Registration is open to anyone, making the prerequisite easily attainable. Exploitation requires composing a crafted POST request to rpc.php with action=applications/post/rpc.php and mode=submit_reply, embedding the malicious payload in the reply_text parameter (e.g., ``) [3]. The attacker's request must include a valid session cookie and referrer header, mimicking a legitimate reply submission. The injected script executes in the browsers of any user who subsequently views the forum thread containing the malicious reply [4].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of other authenticated users' browsers [4]. This can lead to session hijacking, credential theft, defacement of forum content, or redirection to malicious sites. The impact is limited to the victim's browser session and does not directly grant server-side control [4].

Mitigation

As of the available references, no patched version has been released to address this vulnerability [3][4]. Administrators should sanitize user-supplied input in the reply_text parameter, implementing output encoding and Content Security Policy (CSP) headers as a workaround. The affected version 2.20 is the latest, and no official update is available.