CVE-2024-58291

Root

Cause Flatboard 3.2 fails to sanitize user input in the forum information field. This field is intended to allow administrators to add a description or note for a forum, but the application does not properly neutralize HTML or JavaScript content before storing and later rendering it for other users. [2]

Exploitation

An authenticated administrator can craft a malicious payload, such as ">, and insert it into the Information field when creating or editing a forum. The payload is stored server-side and subsequently rendered in the context of other users' browsers without validation, causing the injected script to execute. [3]

Impact

When a victim visits the affected forum page, the injected script executes in their browser session. This allows the attacker to steal session cookies, perform actions on behalf of the victim, or otherwise manipulate the client-side environment. The vulnerability can lead to account compromise and further privilege escalation within the forum. [2]

Mitigation

The vendor has released Flatboard 5.6.0, which likely addresses this issue. Users are strongly advised to upgrade to the latest version [1]. No workaround is available for version 3.2.