The application is vulnerable to Stored HTML Injection on both public profiles and forum topics, allowing attackers to inject arbitrary HTML elements (e.g., <img>, <marquee>, fake login forms). This can be used to run phishing campaigns and display malicious content to other users.
Affected Endpoints
Public Profile:
https:
Forum Topic Creation:
https:
Vulnerability Type
Stored HTML Injection
Content Spoofing / Phishing
Description
User-controlled input is not properly sanitized, allowing HTML tags to be stored and rendered in the application.
An attacker can inject tags such as:
<img> → to display misleading or malicious images
<marquee> → to display fake alerts/messages
<form> → to create fake login pages
This results in persistent malicious content being shown to other users who visit the affected pages.
Steps to Reproduce
Case 1 – Public Profile
Go to profile edit section.
Insert HTML payload:
<img src="https://upload.wikimedia.org/wikipedia/commons/3/3a/Cat03.jpg" width="400">
Save the profile.
Visit the public profile page.
Observe: Injected image is rendered.
Case 2 – Forum Topic
Create a new topic:
https:
Insert payloads like:
<marquee>Fake Announcement</marquee>
<form>Login<br><input><input type=password><button>Login</button></form>
Publish the topic.
Observe: HTML executes and renders for all users.
Impact
Attackers can create fake login forms (phishing attacks).
Ability to display misleading images (fake campaigns, scams).
Content spoofing leading to user trust abuse.
Can be combined with social engineering for credential harvesting.
Persistent across all users → high risk of exploitation.
Proof of Concept
Public Profile:
https:
Forum Topic:
https:
Additional: POC video attached demonstrating execution of:
<img> tag
<marquee> tag
Fake login form
Expected Behavior
All user input should be properly sanitized/escaped.
HTML tags should not be rendered unless explicitly allowed and safely handled.
Actual Behavior
Arbitrary HTML is stored and rendered.
No sanitization or filtering of dangerous tags.
Recommendation
Implement strict HTML sanitization (e.g., allowlist approach).
Escape all user input before rendering.
Block dangerous tags like <script>, <form>, <img>, <marquee>.
Consider using a secure HTML sanitizer (e.g., DOMPurify).
watch poc video attached for better understanding