|
|
|
| Codice: | ::Information about this vulnerabilty
If a moderator or an admin close a thread in phpBB 2.0.X, the sessionid is sending with GET:
http://site.com/path/modcp.php?t=1&mode=lock&sid=[session]
The admin/moderator are going to be redirected to the thread(with the session). If an attacker has posted an image in his post, he can see the referer and so the session id. And if the attacker have a good day and the admin close the thread, he can use all admin-functions with csrf. |
|
|
