CyberRota Analysis
AI-GeneratedElkArte Forum 2.0 Beta 1 contains a stored cross-site scripting vulnerability that allows registered users to inject persistent JavaScript into profile fields, which are then rendered unescaped in administrator views. This could lead to session hijacking or privilege escalation, posing a significant risk to system integrity. Organizations using this version of ElkArte Forum should prioritize patching to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields cust_blurb and cust_locate. The fields are saved without HTML encoding and rendered unescaped in profile views visible to administrators. An attacker can craft a payload that executes in an administrator session, enabling session hijacking or privilege escalation.