Bugtraq mailing list archives
Re: Remote File Include In phpBB-2.0.19
From: neothermic () phpbb com
Date: 24 Mar 2007 21:15:22 -0000
The latest version of phpBB is 2.0.22. Anyone using any version less than that is urged to upgrade. As for the posted exploit, it is invalid. usercp_register.php has always had the following code in it: if ( !defined('IN_PHPBB') ) { die("Hacking attempt"); exit; } It has been there since phpBB 2.0.0; it makes your report invalid because you are unable to set the defined variable in order to bypass this check. We urge people reporting issues to use our security tracker, http://www.phpbb.com/security/, or e-mail security () phpbb com with any issues they find. NeoThermic phpBB Support Team, Audit Team and Incident Investigation Team Leader.
Current thread:
- Remote File Include In phpBB-2.0.19 RaeD Hasadya (Mar 24)
- BOGUS: Remote File Include In phpBB-2.0.19 Cornelius Riemenschneider (Mar 26)
- <Possible follow-ups>
- Re: Remote File Include In phpBB-2.0.19 neothermic (Mar 26)