Orginal Source: http://securityreason.com/achievement_securityalert/31

1. Basically all phpBB admin-side options do allow full HTML, including _java_script__. That is the intended behaviour, as there are legitimate uses. phpBB does however check the Session ID before allowing the changes to go to the data_base_. Your exploit needs a valid admin session key and you need to get the admin to visit the page (unless you happen to have a lot of luck with your IP)- be it by a _link_ or a reflecting page. And even then, it will only work, when the admin has logged into the ACP prior to running into the trap. 2. That is a general problem with all pages allowing of-site pictures. It has been discussed on the list before. Most of your examples won't work with phpBB, due to the missing Session ID in the _link_s. - Hide quoted text -- Show quoted text -