Phpbb Cross-Site Request Forgery

Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments. (2020-03-11, CVE-2019-16107)

phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships. (2020-01-15, CVE-2020-5502)

phpBB 3.2.8 allows a CSRF attack that can modify a group avatar. (2020-01-15, CVE-2020-5501)

In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them. (2019-09-30, CVE-2019-16993)

phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS (2019-09-27, CVE-2019-13376)

The absence of Anti-CSRF tokens may lead to a Cross-Site Request Forgery attack that can result in executing a specific application action as another logged in user, e.g. steal their account by changing their email and password or silently adding a new admin user account when executed from the administrator account.

The attacker may copy one of your web application forms, e.g. email/password change form.

The webpage will contain a form with the exact set of fields as the original application but with input values already provided and the submit button replaced with a Javascript code causing auto-submission. When the page is accessed the form will be immediately submitted and page contents replaced with a valid content or a redirect to your original application.

One of your application users who is already logged in can be then tricked to navigate to such malicious page e.g. by clicking a link in a phishing email, and the pre-populated form content will be submitted to your application like it would be submitted by your user.