Forum Exploits Megaissue

[AustinLMayes]

• You can spam click the action buttons to allow for multiple posts/replies to be made at once.
• Forum categories are not filtered and you can put anything in the value.
• Post titles have no conceivable limit.
• You can use raw html in posts and on profiles.
• You can bypass the script scrubber by putting a space before the closing tag (</script >)
• Profiles with no user found display a blank unpopulated template page.
• You can edit other forum posts by changing the id in the form element on the edit page.
• Categories have no post-permission checking during post creation.

[alexanderjoe]

Forum categories are not filtered and you can put anything in the value. Fixed You can bypass the script scrubber by putting a space before the closing tag (</script >) Should be fixed You can edit other forum posts by changing the id in the form element on the edit page. Fixed

[alexanderjoe]

All issues fixed, except these. Due to them not being replicable. You can spam click the action buttons to allow for multiple posts/replies to be made at once. You can use raw HTML in posts and on profiles.