Description
The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors.
Remediation
References
Related Vulnerabilities
Apache HTTP Server Other Vulnerability (CVE-2005-2728)
Dotclear Other Vulnerability (CVE-2006-3938)
Liferay DXP Incorrect Authorization Vulnerability (CVE-2024-25604)
WordPress Plugin Comments-wpDiscuz Cross-Site Scripting (7.3.1)
Oracle Application Server CVE-2008-2583 Vulnerability (CVE-2008-2583)