-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing CSRF protection in the Remote Avatar feature. phpBB's architecture typically uses check_form_key() for CSRF validation in form handlers. The handle_avatar_remote function in the user profile controller (ucp_profile.php) would be responsible for processing remote avatar URLs. The absence of CSRF token validation in this handler allows forged requests to execute unauthorized avatar changes, leading to session ID theft. This aligns with the CWE-352 (CSRF) and CWE-79 (XSS) classifications, as session hijacking enables stored XSS payload injection via admin privileges.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phpbb/phpbb | composer | <= 3.2.7 | 3.2.8 |
PHPPHPKEV Misses 88% of Exploited CVEs- Get the report