FluxBB 1.5.3 Multiple Remote Vulnerabilities

2013-07-29T00:00:00
ID ZSL-2013-5150
Type zeroscience
Reporter Gjoko Krstic
Modified 2013-07-29T00:00:00

Description

Title: FluxBB 1.5.3 Multiple Remote Vulnerabilities
Advisory ID: ZSL-2013-5150
Type: Local/Remote
Impact: Cross-Site Scripting, Spoofing
Risk: (3/5)
Release Date: 29.07.2013

Summary

FluxBB is fast, light, user-friendly forum software for your website.

Description

FluxBB suffers from a cross-site scripting, cross-site request forgery and URL redirect vulnerability. The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site. Input passed via the 'redirect_url' parameter in 'misc.php' script is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted on a trusted domain. It also fails to properly sanitize user-supplied input to the 'form[board_title]' POST parameter in the 'admin_options.php' script. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user's browser session.

Vendor

FluxBB - <http://www.fluxbb.org>

Affected Version

1.5.3

Tested On

Microsoft Windows 7 Ultimate SP1 (EN)
Apache 2.4.2 (Win32)
PHP 5.4.7
MySQL 5.5.25a

Vendor Status

[14.08.2013] Vendor releases versions 1.5.4 and 1.4.11 to fix these issues.

PoC

fluxbb_multiple.html

Credits

Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>

References

[1] <http://www.exploit-db.com/exploits/27190/>
[2] <http://secunia.com/advisories/54303/>
[3] <http://www.securityfocus.com/bid/61500>
[4] <http://cxsecurity.com/issue/WLB-2013070223>
[5] <http://packetstormsecurity.com/files/122582>
[6] <http://www.osvdb.org/show/osvdb/95805>
[7] <http://www.osvdb.org/show/osvdb/95806>
[8] <http://www.osvdb.org/show/osvdb/95807>
[9] <http://xforce.iss.net/xforce/xfdb/86060>
[10] <http://xforce.iss.net/xforce/xfdb/86061>
[11] <http://fluxbb.org/forums/viewtopic.php?id=7217>
[12] <https://fluxbb.org/development/core/tickets/875/>
[13] <http://www.securiteam.com/securitynews/6I03E0A8UA.html>

Changelog

[29.07.2013] - Initial release
[30.07.2013] - Added reference [2], [3], [4], [5], [6], [7] and [8]
[01.08.2013] - Added reference [9] and [10]
[14.08.2013] - Added vendor status and reference [11] and [12]
[15.11.2013] - Added reference [13]

Contact

Zero Science Lab

Web: <http://www.zeroscience.mk>
e-mail: lab@zeroscience.mk

                                        
                                            &lt;html&gt;&lt;head&gt;&lt;title&gt;403 Nothing to see.&lt;/title&gt;
&lt;link rel="Shortcut Icon" href="favicon.ico" type="image/x-icon"&gt;
&lt;style type="text/css"&gt;
&lt;!--
body {
	background-color: #000;
}
body,td,th {
	font-family: Verdana, Geneva, sans-serif;
}
a:link {
	color: #008FEF;
	text-decoration: none;
}
a:visited {
	color: #008FEF;
	text-decoration: none;
}
a:hover {
	text-decoration: underline;
	color: #666;
}
a:active {
	text-decoration: none;
}
--&gt;
&lt;/style&gt;
&lt;/head&gt;
&lt;body bgcolor=black&gt;
&lt;center&gt;
&lt;font color="#7E88A3" size="2"&gt;
&lt;br /&gt;&lt;br /&gt;
&lt;h1&gt;403 Nothing to see.&lt;/h1&gt;

You do not have the powah for this request /403.shtml&lt;br /&gt;&lt;br /&gt;
&lt;font size="2"&gt;&lt;a href="https://www.zeroscience.mk"&gt;https://www.zeroscience.mk&lt;/a&gt;&lt;/font&gt;
&lt;/font&gt;&lt;/center&gt;
&lt;/body&gt;&lt;/html&gt;