Description

phpBB 2.0.23 includes the session ID in a request to modcp.php when the moderator or administrator closes a thread, which allows remote attackers to hijack the session via a post in the thread containing a URL to a remotely hosted image, which might include the session ID in the Referer header.

Remediation

References

CVE-2008-7143

Related Vulnerabilities

MySQL CVE-2023-22112 Vulnerability (CVE-2023-22112)

Python Integer Overflow or Wraparound Vulnerability (CVE-2022-37454)

PHP Other Vulnerability (CVE-2007-0905)

MySQL CVE-2017-3642 Vulnerability (CVE-2017-3642)

Joomla Improper Authentication Vulnerability (CVE-2022-23795)

Severity

Medium

Classification

CVE-2008-7143 CWE-200

Tags

Missing Update Known Vulnerabilities