VULNERABILITY INTELLIGENCE
CVE-2008-7143
CVSS score6.8 MEDIUM
EPSS probability1.05%
CISA KEVNot currently listed
Published2009-09-01
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:P/I:P/A:P
Description
phpBB 2.0.23 includes the session ID in a request to modcp.php when the moderator or administrator closes a thread, which allows remote attackers to hijack the session via a post in the thread containing a URL to a remotely hosted image, which might include the session ID in the Referer header.
Weakness classification
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor