Title: FluxBB 1.5.3 Multiple Remote Vulnerabilities
Advisory ID: ZSL-2013-5150
Type: Local/Remote
Impact: Cross-Site Scripting, Spoofing
Risk: (3/5)
Release Date: 29.07.2013

Summary

FluxBB is fast, light, user-friendly forum software for your website.

Description

FluxBB suffers from a cross-site scripting, cross-site request forgery and URL redirect vulnerability. The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site. Input passed via the 'redirect_url' parameter in 'misc.php' script is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted on a trusted domain. It also fails to properly sanitize user-supplied input to the 'form[board_title]' POST parameter in the 'admin_options.php' script. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user's browser session.

Vendor

FluxBB - http://www.fluxbb.org

Affected Version

1.5.3

Tested On

Microsoft Windows 7 Ultimate SP1 (EN)
Apache 2.4.2 (Win32)
PHP 5.4.7
MySQL 5.5.25a

Vendor Status

[14.08.2013] Vendor releases versions 1.5.4 and 1.4.11 to fix these issues.

PoC

fluxbb_multiple.html

Credits

Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>

References

[1] http://www.exploit-db.com/exploits/27190/
[2] http://secunia.com/advisories/54303/
[3] http://www.securityfocus.com/bid/61500
[4] http://cxsecurity.com/issue/WLB-2013070223
[5] http://packetstormsecurity.com/files/122582
[6] http://www.osvdb.org/show/osvdb/95805
[7] http://www.osvdb.org/show/osvdb/95806
[8] http://www.osvdb.org/show/osvdb/95807
[9] http://xforce.iss.net/xforce/xfdb/86060
[10] http://xforce.iss.net/xforce/xfdb/86061
[11] http://fluxbb.org/forums/viewtopic.php?id=7217
[12] https://fluxbb.org/development/core/tickets/875/
[13] http://www.securiteam.com/securitynews/6I03E0A8UA.html

Changelog

[29.07.2013] - Initial release
[30.07.2013] - Added reference [2], [3], [4], [5], [6], [7] and [8]
[01.08.2013] - Added reference [9] and [10]
[14.08.2013] - Added vendor status and reference [11] and [12]
[15.11.2013] - Added reference [13]

Contact

Zero Science Lab

Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk