Bugtraq mailing list archives
phpBB 2.0.23 Session Hijacking Vulnerability
From: "nbbn () gmx net" <nbbn () gmx net>
Date: Tue, 18 Mar 2008 23:00:52 +0100
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ phpBB 2.0.23 Session Hijacking Vulnerability + found by NBBN 13 Mar 2008 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
::Information about this vulnerabiltyIf a moderator or an admin close a thread in phpBB 2.0.X, the sessionid is sending with GET:
http://site.tld/phpBB2/modcp.php?t=1&mode=lock&sid=[session]The admin/moderator are going to be redirected to the thread(with the session). If an attacker has posted an image in his post, he can see the referer and so the session id. And if the attacker have a good day and the admin close the thread, he can use all admin-functions with csrf.
::Fix No fix ::Workaround Upgrade to phpBB3 ::Tested under: phpBB 2.0.23 (localhost)
Current thread:
- phpBB 2.0.23 Session Hijacking Vulnerability nbbn () gmx net (Mar 19)