phpBB 2.0.17 and earlier allows remote attackers to bypass protection mechanisms that deregister global variables by setting both a GET/POST/COOKIE (GPC) variable and a GLOBALS[] variable with the same name, which causes phpBB to unset the GLOBALS[] variable but not the GPC variable.
Get an AI-powered plain-language explanation of this vulnerability and remediation steps.
Login to generate AI explanation20 reference(s) from NVD