phpBB versions 2.0.8a and below suffer from an IP spoofing vulnerability that allows a malicious user to post messages and have them be tied to forged IP addresses.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/33114/phpBB208a.txt
Source: https://packetstormsecurity.com/files/33114/phpBB208a.txt.html