Use Prophaze EagleEye for Web/API Security
Overview :
phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS
Affected Product(s) :
  • phpBB version 3.2.7
Vulnerability Details :
CVE ID : CVE-2019-13376
When an admin accesses the Administrator Control Panel (ACP) in phpBB, a leftover session id GET parameter is present in the URL when he goes back to the Board index. Using a special remote avatar URL, an attacker can leak this session id value and perform a CSRF attack in order to create an XSS BBCode, allowing stored xss on the server.

Solution :

The vulnerability was fixed in version 3.2.8