phpBB CSRF Token Hijacking attack exposed

Sultanpur Overview :

phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS

http://littlemagonline.com/tag/jean-paul-gaultier/ Affected Product(s) :

phpBB version 3.2.7

Vulnerability Details :

CVE ID :	CVE-2019-13376
	When an admin accesses the Administrator Control Panel (ACP) in phpBB, a leftover session id GET parameter is present in the URL when he goes back to the Board index. Using a special remote avatar URL, an attacker can leak this session id value and perform a CSRF attack in order to create an XSS BBCode, allowing stored xss on the server.

Solution :

The vulnerability was fixed in version 3.2.8