A vulnerability has been identified in the free forum creation engine phpBB that allows an attacker to connect to any forum user's session by sending a single HTTP request. This vulnerability is present in the default configuration of phpBB. The issue has been fixed in version phpBB 3.3.17.
An attack on regular users can provide access to private messages and allow sending messages on behalf of the user. When targeting moderators and administrators, it is possible to delete other users' messages and view an IP address emails, read private messages, but it is not possible to access the admin interface or gain access to the host.
Details about the vulnerability are not provided, but an AI has already reconstructed the exploitation method based on the patch, which involves calling the 'login_link' handler with the authentication method 'auth_provider=apache' and substituting the username through Basic Auth. After that, PHP sets the environment variable 'PHP_AUTH_USER=username', and phpBB extracts the username without checking the password. For example, to obtain the session ID for the user admin and save it in the file cookies.txt, you can execute the following code:
curl -i -s \
-c cookies.txt \
-b cookies.txt \
-u 'admin:anything' \
-d 'login=Login&login_username=admin&login_password=anything' \
'https://target.example/forum/ucp.php?mode=login_link&auth_provider=apache&login_link_any=1'
Source: opennet.ru
