CVE-2006-0438: CSRF
Cross-site request forgery (CSRF) vulnerability in phpBB 2.0.19, when Link to off-site Avatar or bbcode (IMG) are enabled, allows remote attackers to perform unauthorized actions as a logged in user via a link or IMG tag in a user profile, as demonstrated using links to (1) admin/adminusers.php and (2) modcp.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-0438?
CVE-2006-0438 is considered a high severity vulnerability due to its potential for unauthorized actions as a logged in user.
How do I fix CVE-2006-0438?
To fix CVE-2006-0438, upgrade your phpBB installation to a version that is not affected, specifically after 2.0.19.
What versions of phpBB are affected by CVE-2006-0438?
CVE-2006-0438 affects phpBB versions from 2.0.0 up to and including 2.0.19.
What kind of attacks does CVE-2006-0438 enable?
CVE-2006-0438 enables cross-site request forgery (CSRF) attacks, allowing an attacker to perform actions on behalf of a logged in user.
Can CVE-2006-0438 be exploited without user interaction?
Yes, CVE-2006-0438 can be exploited using specially crafted links or image tags, making it possible for attackers to perform unauthorized actions without user interaction.