Information disclosure in Phpbb

CVE-2008-7143

phpBB 2.0.23 includes the session ID in a request to modcp.php when the moderator or administrator closes a thread, which allows remote attackers to hijack the session via a post in the thread containing a URL to a remotely hosted image, which might include the session ID in the Referer header.

Vulnerability class: Information Disclosure

EPSS: 0.011 (60.8th percentile) — read the EPSS interpretation.

Affected products

  • Phpbb — versions 2.0.23
  • N/a — versions n/a

Weakness classification (CWE)

References