A vulnerability has been discovered in the free forum creation engine phpBB, allowing attackers to connect to any forum user's session by sending a single HTTP request. The vulnerability is present in the default configuration of phpBB. The issue has been fixed in phpBB version 3.3.17.
Attacking regular users can lead to access to private messages and the ability to send messages on behalf of the user. For moderators and administrators, it is possible to delete others' messages and view IP address and email, read private messages, but it is not possible to access the admin interface or gain access to the host.
Details about the vulnerability are not provided, but using AI based on the patch, an exploitation method has been recreated, which involves calling the 'login_link' handler with the authentication method 'auth_provider=apache' and substituting the username via Basic Auth, after which PHP will set the environment variable 'PHP_AUTH_USER=username', and phpBB will extract the username from it without verifying the password. For example, to obtain the session ID of the user admin and save it to the file cookies.txt, the following code can be executed:
curl -i -s \
-c cookies.txt \
-b cookies.txt \
-u 'admin:anything' \
-d 'login=Login&login_username=admin&login_password=anything' \
'https://target.example/forum/ucp.php?mode=login_link&auth_provider=apache&login_link_any=1'
Forrás: opennet.ru
