CVE-2008-7143

CVE-2008-7143 describes a session hijacking vulnerability in phpBB 2.0.23. When a moderator or administrator closes a thread, the session ID is inadvertently included in a request to modcp.php. An attacker can exploit this by embedding a remotely hosted image URL in a thread post, potentially capturing the session ID via the Referer header. This vulnerability has a CVSS score of 6.8 (Medium), indicating it can be exploited remotely with medium complexity, leading to partial confidentiality, integrity, and availability impacts. The EPSS score is low, suggesting a low probability of exploitation. There is no evidence of active exploitation, publicly available exploit code in Metasploit or ExploitDB, or significant community discussion or media coverage surrounding this CVE. It is not listed in CISA's KEV catalog.