Re: Remote File Include In phpBB-2.0.19

[neothermic () phpbb com]

The latest version of phpBB is 2.0.22. Anyone using any version less than that is urged to upgrade.

As for the posted exploit, it is invalid. usercp_register.php has always had the following code in it:
if ( !defined('IN_PHPBB') )
{
        die("Hacking attempt");
        exit;
}

It has been there since phpBB 2.0.0; it makes your report invalid because you are unable to set the defined variable in 
order to bypass this check.

We urge people reporting issues to use our security tracker, http://www.phpbb.com/security/, or e-mail security () 
phpbb com with any issues they find.

NeoThermic
phpBB Support Team, Audit Team and Incident Investigation Team Leader.