PT-2021-10631 · Xiuno Bbs · Xiuno Bbs

Shun-Gg · Published 2021-10-04 · Updated 2021-10-13 · CVE-2020-21494

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Xiuno BBS version 4.0.4

Description: A cross-site scripting (XSS) issue in the install.sql component allows attackers to execute arbitrary web scripts or HTML by changing the doctype value to 0. This enables the execution of malicious scripts, potentially leading to unauthorized actions on the affected system.

Recommendations: For Xiuno BBS version 4.0.4, update the install.sql component to prevent the execution of arbitrary web scripts or HTML by restricting changes to the doctype value. As a temporary workaround, consider restricting access to the install.sql component until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-21494

Affected Products

Xiuno Bbs

References · 5

• 🔥 https://github.com/wanghaiwei/xiuno-docker/issues/4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-21494 · Security Note
• https://osv.dev/vulnerability/CVE-2020-21494 · Vendor Advisory
• https://gitee.com/xiuno/xiunobbs/issues/I16BHH · Note
• https://t.me/cibsecurity/29946 · Telegram Post