Vanilla Forums 2.0.18.8 - Multiple Vulnerabilities

                                                # Exploit Title: Vanilla Forums Insecure Permissions Vulnerability
# Date: 15/5/13
# Exploit Author: Henry Hoggard
# Author Website: http://henryhoggard.co.uk
# Vendor Homepage: http://vanillaforums.org    
# Software Link: http://vanillaforums.org
# Version: 2.0.18.8
# Tested on: Debian
# CVE : none yet

When you make a draft you can view it at a URL like:
/index.php?p=/post/editdiscussion/0/5

However other accounts can view these drafts by just iterating the
number on the end of the url, such as
/index.php?p=/post/editdiscussion/0/1
/index.php?p=/post/editdiscussion/0/2
etc

# Exploit Title: Vanilla Forums 2.0.18.8 & 2.1 XSS
# Date: May 12 2013
# Exploit Author: Henry Hoggard
# Author URL: http://henryhoggard.co.uk
# Vendor Homepage: http://vanillaforums.org
# Software Link: http://vanillaforums.org
# Version: Vanilla 2.0.18.8
# Tested on: Debian

This occurs in the flagging function.

Tutorial
Flag a post with any flag reason.

Flag the exact same post again, this time with your XSS script
<script>alert(1)</script>

The XSS will trigger on the admin dashboard.