Let me start by saying that the notion that XSS can only be used to harvest cookies is a very common misconception.
The truth is that, with XSS, any action a user may do on the vulnerable site (that doesn't require a password) can be mimicked.
With an XSS vector in the board title (meaning the JavaScript would be injected into the page listing all boards) it would be possible to force all visitors to participate in a DDoS attack against this site. If I'm not mistaken, it would be possible to force the participation in a DDoS against ANY site. I'm fairly certain that cross-site ajax works fine in modern browsers, but without cookies to prevent abuse- cookies are not necessary for DDoS.
Edit/Note: This does mean that any site could force visitors to participate in a DDoS attack. What prevents this from becoming common is the number of visitors required for a DDoS attack to succeed.
This would probably not work on this site because the number of users is only ~6000. I don't know how many users would actually be required to dent a typical site. I do know that "Anonymous" recently used a client side DDoS tool on a large number of users.
Comments
Let me start by saying that the notion that XSS can only be used to harvest cookies is a very common misconception. The truth is that, with XSS, any action a user may do on the vulnerable site (that doesn't require a password) can be mimicked.
With an XSS vector in the board title (meaning the JavaScript would be injected into the page listing all boards) it would be possible to force all visitors to participate in a DDoS attack against this site. If I'm not mistaken, it would be possible to force the participation in a DDoS against ANY site. I'm fairly certain that cross-site ajax works fine in modern browsers, but without cookies to prevent abuse- cookies are not necessary for DDoS.
Edit/Note: This does mean that any site could force visitors to participate in a DDoS attack. What prevents this from becoming common is the number of visitors required for a DDoS attack to succeed.
This would probably not work on this site because the number of users is only ~6000. I don't know how many users would actually be required to dent a typical site. I do know that "Anonymous" recently used a client side DDoS tool on a large number of users.
Edit 2: In light of http://news.ycombinator.com/item?id=4000301, I'll point out that XSS could result in the forced posting of illegal content, as well.