xss bypass the filter in pbboard/pbboard-3.0.4


Reported on

Jan 31st 2023


hi,@maintainer.The filter you use to clean xss is unsafe.Please choose an xss filter with a large number of users and a high evaluation

Video link

You can watch my video through this link first. link https://drive.google.com/file/d/1mh9hiDxmybLQGPw-z36qBdsEcE_OoPw8/view?usp=share_link

Proof of Concept

1.Login to the forum as any user.

2.Send dangerous messages to admin users.

3.The value of the Message is below

<a/href="1"/onclick="&#97;&#108;&#101;&#114;&#116;&#40;&#100;&#111;&#99;&#117;&#109;&#101;&#110;&#116;&#46;&#99;&#111;&#111;&#107;&#105;&#101;&#41;">click me</a>

4.Admin users view the Message sent by the attacker.Click the link the attacker sent.


(1) To steal the administrator account or cookie, the intruder can log in to the background as an administrator. It enables intruders to manipulate background data maliciously, including reading, changing, adding and deleting some information.

(2) Stealing users' personal information or login accounts will pose a huge threat to the user security of the website. For example, pretend to be a user for various operations.

(3) The website hangs horses. First, embed the malicious attack code into the Web application. When the user browses the hanging horse page, the user's computer will be implanted with a Trojan horse.

(4) Send advertisements or spam messages. Attackers can use XSS vulnerabilities to plant advertisements or send spam, seriously affecting

We are processing your report and will contact the pbboard/pbboard-3.0.4 team within 24 hours. 2 months ago
Christy__ modified the report
2 months ago
PBBoard Forum Software validated this vulnerability 2 months ago

I fixed it and Update XSS filtering


Thanks again

Christy__ has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
2 months ago

Now will be well-used filter and a more secure

Update XSS filtering https://github.com/pbboard/PBBoard-3.0.4/commit/8a8787ec8fe40a7c171926497564f94e76e4dbbb

Christy__ submitted a
2 months ago
2 months ago


hi, @admin ,The bug has been fixed, but the maintainer told me that he had a 'commit sha not found in repository' when marking the report as fixed. Can you mark the report as fixed, thanks.And the commit is https://github.com/pbboard/PBBoard-3.0.4/commit/a3e24e86cffd7b4c8f8a575f09dc2316010ab715

Ben Harvie
a month ago


I seem to be able to submit the fix with no issue using SHA: a3e24e86cffd7b4c8f8a575f09dc2316010ab715

@maintainer, if you could please try again with the SHA above and provide your publication preferences?

a month ago


hi, @admin ,I contacted the manager of the project through email, but he still couldn't mark this report successfully. the commit is https://github.com/pbboard/PBBoard-3.0.4/commit/a3e24e86cffd7b4c8f8a575f09dc2316010ab715 . You can also verify whether the vulnerability has been fixed .I hope you can help us, which is very important to me, thank you

23 days ago


hi, @admin ,could you help us to mark this report as fixed.We have confirmed that the vulnerability was successfully repaired.Thanks

Ben Harvie marked this as fixed in 3.0.4 with commit a3e24e 22 days ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
Ben Harvie published this vulnerability 22 days ago
to join this conversation