Secunia

Wang has reported a vulnerability in phpBB, which can be exploited by malicious users to circumvent certain administrative user management features.

The vulnerability is caused due to an input validation error within the handling of remote IP addresses. This can be exploited by specifying a fake IP address in the "HTTP_X_FORWARDED_FOR" header, which hides the user's IP address and therefore makes it impossible for an administrator to track or ban the user.

This does not affect the web server, which still logs the correct IP address.

The issue has been reported in versions 2.0.8a and prior.

Solution
Update to version 2.0.9.

Provided and/or discovered by
Wang / SRR Project Group of Ready Response

Deep Links
Links available in Customer Area