CVE-2019-16993: phpBB Cross-Site Request Forgery (CSRF)
Summary
CVE-2019-16993: phpBB Cross-Site Request Forgery (CSRF). Affects phpbb/phpbb versions < 3.1.7-PL1. Fixed in 3.1.7-PL1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpBB is a popular open-source forum software written in PHP. It provides a platform for users to create and manage online communities. The vulnerability in question affects versions of phpBB prior to 3.1.7-PL1. phpBB includes a feature called BBCode, which allows users to format their posts using special tags. The Administration Control Panel (ACP) is a privileged area where administrators can manage the forum settings. The vulnerability lies in the improper verification of a CSRF token on the BBCode page in the ACP. This means that an attacker can exploit this vulnerability to perform Cross-Site Request Forgery attacks if they can also retrieve the session ID of a reauthenticated administrator prior to targeting them.
Vulnerability Detail
The vulnerability allows an attacker to perform Cross-Site Request Forgery attacks on phpBB installations. By tricking a reauthenticated administrator into visiting a specially crafted webpage, the attacker can make unauthorized changes to the forum settings or perform actions on behalf of the administrator. This can lead to various security risks, such as defacement of the forum, unauthorized access to sensitive information, or even complete compromise of the system. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
3.1.7-PL1
This is the first release that contains the fix.
composer require phpbb/phpbb:3.1.7-PL1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to disable the BBCode feature in the ACP. This can be done by modifying the configuration settings of phpBB. However, disabling BBCode will remove the ability for users to format their posts using BBCode tags.
Conclusion
In conclusion, the phpBB Cross-Site Request Forgery (CSRF) vulnerability can be exploited by attackers to perform unauthorized actions on phpBB installations. It is crucial to upgrade to the latest version of phpBB to mitigate this vulnerability. If immediate upgrading is not possible, disabling the BBCode feature in the ACP can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpbb/phpbb →
FAQ
phpBB is an open-source forum software written in PHP that allows users to create and manage online communities.
Cross-Site Request Forgery is an attack that tricks the victim into performing unwanted actions on a website without their knowledge or consent.
The Administration Control Panel is a privileged area where administrators can manage the forum settings and perform administrative tasks.
An attacker can exploit this vulnerability by tricking a reauthenticated administrator into visiting a specially crafted webpage that performs unauthorized actions on their behalf.
The potential consequences include defacement of the forum, unauthorized access to sensitive information, and complete compromise of the system.
Related vulnerabilities
Recent vulnerabilities recorded for phpbb/phpbb.
