MyBB 1.6.10 'url' Parameter Arbitrary Site Redirection Vulnerability

Title: MyBB 1.6.10 'url' Parameter Arbitrary Site Redirection Vulnerability
Advisory ID: ZSL-2013-5152
Type: Local/Remote
Impact: Spoofing
Risk: (2/5)
Release Date: 07.08.2013
Summary
MyBB, also known as MyBBoard or MyBulletinBoard, is a powerful, efficient, and free forum package, developed using PHP and MySQL.
Description
Input passed via the 'url' parameter in 'member.php' script is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted on a trusted domain.
Vendor
MyBB Group - http://www.mybb.com
Affected Version
1.6.10
Tested On
Microsoft Windows 7 Ultimate SP1 (EN)
Apache 2.4.2 (Win32)
PHP 5.4.7
MySQL 5.5.25a
Vendor Status
[02.08.2013] Vulnerability discovered.
[06.08.2013] Vendor has knowledge about the issue.
[07.08.2013] Public security advisory released.
PoC
mybb_redirect.txt
Credits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>
References
[1] http://packetstormsecurity.com/files/122724
[2] http://cxsecurity.com/issue/WLB-2013080057
[3] http://xforce.iss.net/xforce/xfdb/86312
Changelog
[07.08.2013] - Initial release
[17.08.2013] - Added reference [3]
Contact
Zero Science Lab

Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk