Cross-site Request Forgery (CSRF)

phpbb/phpbb is vulnerable to cross-site request forgery CSRF attacks. These attacks are possible because the library does not correctly validate the form key in the messageoptions function in includes/ucp/ucppmoptions.php...

CVE-2015-1432

The messageoptions function in includes/ucp/ucppmoptions.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors...

CVE-2015-1432

The messageoptions function in includes/ucp/ucppmoptions.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors...