FluxBB 1.5.3 Multiple Remote Vulnerabilities

Title: FluxBB 1.5.3 Multiple Remote Vulnerabilities
Advisory ID: ZSL-2013-5150
Type: Local/Remote
Impact: Cross-Site Scripting, Spoofing
Risk: (3/5)
Release Date: 29.07.2013
Summary
FluxBB is fast, light, user-friendly forum software for your website.
Description
FluxBB suffers from a cross-site scripting, cross-site request forgery and URL redirect vulnerability. The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site. Input passed via the 'redirect_url' parameter in 'misc.php' script is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted on a trusted domain. It also fails to properly sanitize user-supplied input to the 'form[board_title]' POST parameter in the 'admin_options.php' script. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user's browser session.
Vendor
FluxBB - http://www.fluxbb.org
Affected Version
1.5.3
Tested On
Microsoft Windows 7 Ultimate SP1 (EN)
Apache 2.4.2 (Win32)
PHP 5.4.7
MySQL 5.5.25a
Vendor Status
[14.08.2013] Vendor releases versions 1.5.4 and 1.4.11 to fix these issues.
PoC
fluxbb_multiple.html
Credits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>
References
[1] http://www.exploit-db.com/exploits/27190/
[2] http://secunia.com/advisories/54303/
[3] http://www.securityfocus.com/bid/61500
[4] http://cxsecurity.com/issue/WLB-2013070223
[5] http://packetstormsecurity.com/files/122582
[6] http://www.osvdb.org/show/osvdb/95805
[7] http://www.osvdb.org/show/osvdb/95806
[8] http://www.osvdb.org/show/osvdb/95807
[9] http://xforce.iss.net/xforce/xfdb/86060
[10] http://xforce.iss.net/xforce/xfdb/86061
[11] http://fluxbb.org/forums/viewtopic.php?id=7217
[12] https://fluxbb.org/development/core/tickets/875/
[13] http://www.securiteam.com/securitynews/6I03E0A8UA.html
Changelog
[29.07.2013] - Initial release
[30.07.2013] - Added reference [2], [3], [4], [5], [6], [7] and [8]
[01.08.2013] - Added reference [9] and [10]
[14.08.2013] - Added vendor status and reference [11] and [12]
[15.11.2013] - Added reference [13]
Contact
Zero Science Lab

Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk