CVE-2018-25384: Stored XSS in Wikidforum 2.20 Allows Authenticated Attackers to Inject Malicious Scripts

Technical summary

CVE-2018-25384 is a stored XSS vulnerability in Wikidforum 2.20 affecting the reply_text parameter processed by rpc.php. The vulnerability stems from insufficient input sanitization and output encoding of user-supplied HTML in forum reply submissions. An authenticated attacker can craft HTML payloads containing JavaScript that persist in the database and execute client-side when other users browse affected forum threads. The CVSS 3.1 score of 5.4 (MEDIUM) reflects the requirement for user authentication and user interaction (clicking/viewing), which constrains the attack surface, though the scope is changed (XSS payload executes in victim's security context).

Business impact

Compromised forum integrity undermines user trust and community engagement. Attackers can harvest session tokens, credentials, or personal information from forum members. Defaced or redirected forum content may harm the reputation of the forum operator and expose users to malware or phishing campaigns. For organizations using Wikidforum as an internal collaboration tool, this creates a lateral movement vector for insider threats or compromised accounts to spread malicious content across the user base.

Affected systems

Wikidforum version 2.20 is confirmed vulnerable. No vendor product data was provided in the advisory; verify whether your deployment runs this specific version and whether older or newer releases are also affected by consulting the Wikidforum project documentation or security advisories.

Exploitability

Exploitation requires valid forum authentication credentials, reducing opportunistic attack likelihood. However, the barrier is low if credentials are obtained through phishing, weak passwords, or insider access. Once authenticated, injecting malicious HTML into replies is trivial—no special tools or bypass techniques are needed. User interaction is required (victims must view the malicious post), but this is probable in active forum communities. The stored nature of the XSS means the payload persists, allowing multiple victims to be compromised over time without repeated attacker intervention.

Remediation

Upgrade Wikidforum to a patched version that sanitizes and encodes the reply_text parameter. If an immediate patch is unavailable, implement input validation to reject or strip HTML tags from user submissions, and apply output encoding (HTML entity encoding) when rendering forum replies. Consider deploying a Web Application Firewall (WAF) to detect and block common XSS payloads. Educate users not to click suspicious links within forum posts and encourage them to clear browser cookies/session tokens if they suspect compromise.

Patch guidance

Consult the Wikidforum project repository or security advisory for the patched version addressing CVE-2018-25384. Apply patches in a staging environment first to verify compatibility with your forum configuration, custom extensions, and database. After patching, clear any cached forum data and consider auditing historical forum posts for injected malicious scripts that may have been posted before the update.

Detection guidance

Monitor rpc.php endpoint logs for POST requests to reply_text parameters containing suspicious keywords such as '<script>', 'javascript:', 'onerror=', 'onclick=', or base64-encoded payloads. Use SIEM rules to correlate authentication events with unusual HTML submissions. In-browser detection: users experiencing unexpected redirects, pop-ups, or session logouts after viewing forum posts should report the incident immediately. Database audits can identify stored XSS payloads in forum reply records by searching for script tags or event handler attributes.

Why prioritize this

Although CVSS 5.4 is MEDIUM severity, this vulnerability merits prompt attention because stored XSS in community platforms scales rapidly—a single malicious post compromises all subsequent viewers. The authentication requirement and user interaction lower the immediate risk compared to unauthenticated RCE, but the persistence and scope (impacts other users' security contexts) elevate risk beyond typical reflected XSS. Prioritize patching if your forum is actively used and handles sensitive user data or internal communication.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects a network-accessible, low-complexity attack requiring valid authentication (PR:L) and user interaction (UI:R). Confidentiality and integrity are slightly impacted (C:L, I:L) as attackers can steal session data or deface posts, but there is no availability impact. The 'changed scope' (S:C) indicates the XSS executes in another user's browser session, escalating the severity beyond a self-XSS attack. The MEDIUM rating appropriately balances the ease of exploitation against the authentication gate and user-interaction requirement.

Frequently asked questions