CNVD-2019-01348 Scanner

Xiuno BBS is a lightweight, open-source bulletin board system designed for creating online forums. It is widely used by web developers, community managers, and hobbyists who need a fast, customizable platform for discussions. The software's simplicity and plugin ecosystem make it popular for small to medium-sized communities, educational groups, and niche interest forums. Its minimal resource requirements allow deployment on shared hosting, making it accessible to non-technical users.

The CNVD-2019-01348 vulnerability, also known as a system reinstallation flaw, arises because Xiuno BBS does not automatically remove or restrict access to its installation script after the initial setup. This oversight allows anyone who can reach the install directory to rerun the setup process. The vulnerability is classified as critical (CVSS 7.5) because it requires no authentication and can be exploited remotely.

Technically, the flaw resides in the install/index.php endpoint, which remains accessible post-installation. An attacker can simply navigate to /install/ and trigger the reinstallation wizard. The script does not check for an existing configuration file or lock file to prevent multiple installations. This allows the attacker to overwrite the database connection settings, admin credentials, and site configuration.

If exploited, an attacker can completely reset the forum, deleting all user accounts, posts, and settings. They can then create a new admin account, gaining full control over the system. This can lead to data loss, defacement, or use of the forum for malicious activities like phishing. The impact is severe for active communities, as trust and content are irreversibly compromised.