A Cross‑Site Request Forgery flaw exists in the login routine of PhpBB phbb3 version 3.3.15. By submitting a crafted request that mimics a legitimate authentication attempt, an attacker can inject code that the PHP interpreter executes. The flaw maps to the misuse of request validation (CWE‑352). Successful exploitation results in arbitrary code execution with the privileges of the web server process, allowing complete compromise of the affected site.

The vulnerability affects installations of the PhpBB phbb3 forum software running version 3.3.15. No other product variants or vendors are listed, so any deployment of that specific version is exposed.

The base CVSS score of 8.8 reflects a high severity level. An EPSS score below 1 % indicates that exploitation is currently rare, and the issue has not appeared in the CISA Known Exploited Vulnerabilities catalog. An attacker who can send crafted requests from a local browsing session or a compromised account can trigger the login route and cause PHP to execute arbitrary code. The requirement for direct engagement with the authentication endpoint means the attack is limited to situations where the attacker can access the login form; however, because the flaw arises from a CSRF condition, it may be feasible from a previously compromised user browser or by using a victim’s session cookie.