V2Board ≤1.7.4 Multiple Vulnerabilities (CVE-2026-37503/37504/37505)

advisory_v2board_v2.md

# V2Board ≤ 1.7.4 Multiple Vulnerabilities

**Vendor**: V2Board (github.com/v2board/v2board) — unmaintained since 2023  
**Affected**: ≤ 1.7.4 (all versions; project abandoned)  
**Reporter**: Feng Ning, Innora Security Research (feng@innora.ai)  
**Disclosure**: 2026-04-30  

| CVE | Type | CWE | Location |
|-----|------|-----|----------|
| CVE-2026-37503 | Stored XSS | CWE-79 | theme configuration custom_html |
| CVE-2026-37504 | Sensitive Token Exposure | CWE-598 | Server/UniverseController |
| CVE-2026-37505 | SQL Injection | CWE-89 | Admin/UserController ORDER BY |

---

## CVE-2026-37503 — Stored XSS via custom_html

Theme configuration renders the `custom_html` field through Blade's unescaped interpolation (`{!! $theme_config["custom_html"] !!}`), with no sanitization step anywhere in the pipeline. An admin — or any user with theme configuration access — can plant JavaScript that executes persistently for every visitor who loads the page.

**Fix**: switch to `{{ }}` escaped output, or apply `wp_kses`-equivalent filtering before storage.

---

## CVE-2026-37504 — server_token Exposed via GET

In `app/Http/Controllers/Server/UniverseController.php`, the `server_token` rides along as a URL query parameter. That's a problem: web servers log query strings, proxies cache them, browser history retains them. The token leaks passively — no active exploitation required, just normal infrastructure behaviour.

**Fix**: move token acceptance to a request header or POST body. Query parameters are not an appropriate channel for credentials.

---

## CVE-2026-37505 — SQL Injection via ORDER BY

`app/Http/Controllers/Admin/UserController.php` builds its `ORDER BY` clause by concatenating user-supplied column and direction values directly into the query. No parameterization, no allowlist. An authenticated admin can break out of the intended clause and inject arbitrary SQL through the sort parameter.

**Fix**: validate column names against a hard-coded allowlist; the direction value (`ASC`/`DESC`) should never reach the query without an explicit check.

---

*Innora Security Research — https://innora.ai*