Description
In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them.
Remediation
References
Related Vulnerabilities
Jboss EAP Improper Input Validation Vulnerability (CVE-2011-4314)
Handlebars Other Vulnerability (CVE-2021-23383)
WordPress Plugin Wordfence Security-Firewall & Malware Scan Unspecified Vulnerability (5.3.2)
CrushFTP Server Improper Validation of Integrity Check Value Vulnerability (CVE-2023-48795)
WordPress Plugin Form Store to DB Unspecified Vulnerability (1.1.0)