CVE-2006-0438

Published: Feb 6, 2006Modified: Apr 16, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Cross-site request forgery (CSRF) vulnerability in phpBB 2.0.19, when Link to off-site Avatar or bbcode (IMG) are enabled, allows remote attackers to perform unauthorized actions as a logged in user via a link or IMG tag in a user profile, as demonstrated using links to (1) admin/admin_users.php and (2) modcp.php.

Affected (29)

Products: Phpbb Group: Phpbb

Phpbb Group

1 product

Phpbb

Configuration A

29 vulnerable

Vulnerable Software	Affected Versions
Phpbb Group Phpbb	Version 2.0.0
Phpbb Group Phpbb	Version 2.0.10
Phpbb Group Phpbb	Version 2.0.11
Phpbb Group Phpbb	Version 2.0.12
Phpbb Group Phpbb	Version 2.0.13
Phpbb Group Phpbb	Version 2.0.14
Phpbb Group Phpbb	Version 2.0.15
Phpbb Group Phpbb	Version 2.0.16
Phpbb Group Phpbb	Version 2.0.17
Phpbb Group Phpbb	Version 2.0.18
Phpbb Group Phpbb	Version 2.0.19
Phpbb Group Phpbb	Version 2.0.1
Phpbb Group Phpbb	Version 2.0.2
Phpbb Group Phpbb	Version 2.0.3
Phpbb Group Phpbb	Version 2.0.4
Phpbb Group Phpbb	Version 2.0.5
Phpbb Group Phpbb	Version 2.0.6
Phpbb Group Phpbb	Version 2.0.6c
Phpbb Group Phpbb	Version 2.0.6d
Phpbb Group Phpbb	Version 2.0.7
Phpbb Group Phpbb	Version 2.0.7a
Phpbb Group Phpbb	Version 2.0.8
Phpbb Group Phpbb	Version 2.0.8a
Phpbb Group Phpbb	Version 2.0.9
Phpbb Group Phpbb	Version 2.0_beta1
Phpbb Group Phpbb	Version 2.0_rc1
Phpbb Group Phpbb	Version 2.0_rc2
Phpbb Group Phpbb	Version 2.0_rc3
Phpbb Group Phpbb	Version 2.0_rc4