A 10-year-old authentication bypass vulnerability found in the phpBB forum software enables an attacker to log in as any user, including those with administrator privileges.
The flaw lacks an identifier and is easily exploitable with a single HTTP request. It impacts phpBB versions 4.0.0-a2 and 3.3.16, as well as all earlier iterations.
Researchers at the application security firm Aikido discovered the bug on June 2 and reported it through the developer’s HackerOne Vulnerability Disclosure Program.
phpBB responded promptly to the report and resolved the issue on June 6 in version 3.3.17 of the software.
According to Aikido, the flaw was introduced into phpBB’s codebase 10 years ago, affecting all versions of the 3.x and 4.x release lines, up to and including 3.3.16 and 4.0.0-a2. For the 4.x release, no fix is currently available.
phpBB is a free and open-source PHP-based web forum platform that reached its peak popularity in the 2000s and early 2010s. Today, it still powers thousands of forums worldwide.
Aikido states that exploiting the bug requires no special configuration, as it can be triggered using default settings.
“The vulnerability is exploitable in the default configuration and requires no special knowledge,” Aikido’s report states.
“If you are on version 4.0.0-a2 or 3.3.16 and below, upgrade immediately to master (no safe 4.x release yet) and 3.3.17, respectively, to avoid compromise.”
Administrator access could enable attackers to view all private messages stored on the forum, create, modify, or delete content and user accounts, impersonate staff, or deface the sites.
Identifying targets is also simple, as the member list on phpBB forums is public by default.
Aikido notes that remote code execution (RCE) is not possible due to a separate password check that safeguards the Admin Control Panel.
The researchers have withheld all technical details for now to allow forum administrators sufficient time to apply the security updates and even contacted administrators of large phpBB-based forums to alert them directly.
One point to note is that the update may cause forums using OAuth authentication to break, because the OAuth redirect handler has moved to a new location, but this should be a straightforward fix in most cases.
Aikido has promised to publish the full details of the flaw in a future report but did not provide a specific timeline.
Test every layer before attackers do
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Related Articles:
SAP fixes critical flaws in NetWeaver and Commerce Cloud
Palo Alto GlobalProtect VPN auth bypass flaw now exploited in attacks
Hackers exploit FortiClient EMS flaw to push infostealer malware
Hackers bypass SonicWall VPN MFA due to incomplete patching
Hackers exploit auth bypass flaw in Burst Statistics WordPress plugin