SSD Advisory – phpBB CSRF Token Hijacking leading to Stored XSS
Vulnerability SummaryWhen an admin accesses the Administrator Control Panel (ACP) in phpBB, a leftover session id GET parameter is present in the URL when he goes back to the Board index. Using a special remote avatar URL, an attacker can leak this session id value and perform a CSRF attack in order to create an …
SSD Advisory – phpBB CSRF Token Hijacking leading to Stored XSS Read More »
