CVE-2004-1950

Vulnerability

In phpBB 2.0.8a and earlier, the common.php script uses the HTTP_X_FORWARDED_FOR header to determine the user's IP address without proper validation. The vulnerable code (lines 126-146) blindly trusts the first public IP from the header, enabling an attacker to spoof their IP [1][2].

Exploitation

An attacker can send an HTTP request with a crafted X-Forwarded-For header containing an arbitrary IP address. phpBB will then log that spoofed IP for the user's session. No authentication or special privileges are required; the attacker only needs to be able to send HTTP requests to the server [1].

Impact

By spoofing their IP, an attacker can bypass IP-based bans or appear as another user, potentially enabling further abuse. This does not directly lead to remote code execution, but it undermines IP-based security controls and forensic logging [1].

Mitigation

The recommended fix is to remove the vulnerable code entirely. A patch is provided in [2] that deletes the X-Forwarded-For handling logic, falling back to REMOTE_ADDR. phpBB later released version 2.0.9, which addresses this issue [1][2].