http://www.k-otik.com/english/advisories/2005/0212
phpBB Administrator Session Handling Critical Security Update
K-OTik Security Advisory : KOTIK/ADV-2005-0212
CVE Reference : GENERIC-MAP-NOMATCH
Rated as : High
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2005-02-28
* Technical Description *
Two vulnerabilities were reported in phpBB, which may be exploited by attackers to determine the installation path or bypass certain security features. The first problem resides in the "autologinid" (includes/sessions.php) variable and could be exploited by malicious users to gain administrator rights. The second flaw resides in the "viewtopic.php" script, and could be exploited to disclose the webroot path.
