Re: Remote File Include In phpBB-2.0.19
The latest version of phpBB is 2.0.22. Anyone using any version less than that
is urged to upgrade.
As for the posted exploit, it is invalid. usercp_register.php has always had
the following code in it:
if ( !defined('IN_PHPBB') )
{
die("Hacking attempt");
exit;
}
It has been there since phpBB 2.0.0; it makes your report invalid because you
are unable to set the defined variable in order to bypass this check.
We urge people reporting issues to use our security tracker,
http://www.phpbb.com/security/, or e-mail security@xxxxxxxxx with any issues
they find.
NeoThermic
phpBB Support Team, Audit Team and Incident Investigation Team Leader.