FluxBB 1.5.3 Multiple Remote Vulnerabilities

Title: FluxBB 1.5.3 Multiple Remote Vulnerabilities
Advisory ID: ZSL-2013-5150
Type: Local/Remote
Impact: Cross-Site Scripting, Spoofing
Risk: (3/5)
Release Date: 29.07.2013
FluxBB is fast, light, user-friendly forum software for your website.
FluxBB suffers from a cross-site scripting, cross-site request forgery and URL redirect vulnerability. The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site. Input passed via the 'redirect_url' parameter in 'misc.php' script is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted on a trusted domain. It also fails to properly sanitize user-supplied input to the 'form[board_title]' POST parameter in the 'admin_options.php' script. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user's browser session.
FluxBB - http://www.fluxbb.org
Affected Version
Tested On
Microsoft Windows 7 Ultimate SP1 (EN)
Apache 2.4.2 (Win32)
PHP 5.4.7
MySQL 5.5.25a
Vendor Status
[14.08.2013] Vendor releases versions 1.5.4 and 1.4.11 to fix these issues.
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>
[1] http://www.exploit-db.com/exploits/27190/
[2] http://secunia.com/advisories/54303/
[3] http://www.securityfocus.com/bid/61500
[4] http://cxsecurity.com/issue/WLB-2013070223
[5] http://packetstormsecurity.com/files/122582
[6] http://www.osvdb.org/show/osvdb/95805
[7] http://www.osvdb.org/show/osvdb/95806
[8] http://www.osvdb.org/show/osvdb/95807
[9] http://xforce.iss.net/xforce/xfdb/86060
[10] http://xforce.iss.net/xforce/xfdb/86061
[11] http://fluxbb.org/forums/viewtopic.php?id=7217
[12] https://fluxbb.org/development/core/tickets/875/
[13] http://www.securiteam.com/securitynews/6I03E0A8UA.html
[29.07.2013] - Initial release
[30.07.2013] - Added reference [2], [3], [4], [5], [6], [7] and [8]
[01.08.2013] - Added reference [9] and [10]
[14.08.2013] - Added vendor status and reference [11] and [12]
[15.11.2013] - Added reference [13]
Zero Science Lab

Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk