Remote attackers can exploit the session handling flaw to gain phpBB administrator rights. By providing a local and a remote location for an avatar and setting the "Upload Avatar from a URL:" field to point to the target file, a malicious local user can read arbitrary local files. By inserting "/../" sequences into the "avatarselect" parameter, a remote attacker can exploit the directory traversal vulnerability to delete arbitrary files. A flaw in the "viewtopic.php" script can be exploited to expose the full path of PHP scripts.