Carbon Forum 5.9.0 Cross Site Scripting

`# Exploit Title: Persistent XSS in Carbon Forum 5.9.0 (Stored)  
# Date: 06/12/2024  
# Exploit Author: Chokri Hammedi  
# Vendor Homepage: https://www.94cb.com/  
# Software Link: https://github.com/lincanbin/Carbon-Forum  
# Version: 5.9.0  
# Tested on: Windows XP  
# CVE: N/A  
  
## Vulnerability Details  
  
A persistent (stored) XSS vulnerability was discovered in Carbon Forum  
version 5.9.0. The vulnerability allows an attacker to inject malicious  
JavaScript code into the Forum Name field under the admin settings. This  
payload is stored on the server and executed in the browser of any user who  
visits the forum, leading to potential session hijacking, data theft, and  
other malicious activities.  
  
## Steps to Reproduce  
  
1. Login as Admin: Access the Carbon Forum with admin privileges.  
2. Navigate to Settings: Go to the '/dashboard' and select the Basic  
section.  
3. Enter Payload : Input the following payload in the Forum Name field:  
  
<script>alert('XSS');</script>  
  
4. Save Settings: Save the changes.  
5. The xss payload will triggers  
`