Uploaded image for project: 'phpBB'
  1. phpBB
  2. PHPBB-17583

False Positive Cloudflare WAF

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Minor Minor
    • None
    • 3.3.15
    • ACP
    • None

      Cloudflare rule and ID:
       
      HTTP parameter pollution - cb67fe56a84747b8b64277dc091e296d
      https://developers.cloudflare.com/changelog/2025-10-17-emergency-waf-release/

       

      Appears this is only active in Pro plan or better hence the reason no one reporting it in Support. Example after clicking yes to confirm purge cache, the request has duplicate SID parameter but it does have same value. 

      /adm/index.php?i=acp_main&mode=main&sid=XXX&confirm_key=XXX&confirm_uid=2&sess=XXX&sid=XXX

       

            Unassigned Unassigned
            thecoalman thecoalman
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated: