FluxBB Multiple Security Vulnerabilities

Bugtraq ID:	61500
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Jul 29 2013 12:00AM
Updated:	Jul 29 2013 12:00AM
Credit:	Gjoko Krstic
Vulnerable:
Not Vulnerable:

FluxBB Multiple Security Vulnerabilities

FluxBB is prone to a cross-site scripting vulnerability, a cross-site request-forgery vulnerability and an URI-redirection vulnerability.

An attacker may exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, conduct phishing attacks and disclose or modify sensitive information. Other attacks may also be possible.

FluxBB 1.5.3 is vulnerable; other versions may also be affected.

FluxBB Multiple Security Vulnerabilities

To exploit these issues an attacker must entice an unsuspecting victim into following a malicious URI or visiting a malicious website.

The following example data is available:

• /data/vulnerabilities/exploits/61500.txt

FluxBB Multiple Security Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

FluxBB Multiple Security Vulnerabilities

References:

• FluxBB 1.5.3 Multiple Remote Vulnerabilities (Zero Science Lab)
  
• FluxBB Homepage (FluxBB)