SECURITY WARNING: Anyone using phpBB?

[swedguy]

http://www.securityfocus.com/bid/9122

It has been reported that phpBB may be prone to a SQL injection vulnerability that may allow an attacker to disclose sensitive information by supplying malicious SQL code to the underlying database.

phpBB version 2.06 has been prone to this issue, however other versions may be affected as well.

[ThePornPusher]

Thanks for the heads up...

[dirtysouth]

Thanks!

[extreme]

open search.php, line ~685:

Replace

if ( intval($search_id) )
      {
         $sql = "SELECT search_array
            FROM " . SEARCH_TABLE . "
            WHERE search_id = $search_id 
               AND session_id = '". $userdata['session_id'] . "'";

with

 $search_id = intval($search_id);
      if ( $search_id )
      {
         $sql = "SELECT search_array
            FROM " . SEARCH_TABLE . "
            WHERE search_id = $search_id 
               AND session_id = '". $userdata['session_id'] . "'";

Info from a trusted source, phpbbs own site: http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=153818

[swedguy]

a last bump

[ZoiNk]

A lot of ppl use that, hope everyone gets their fixed fast.
*mini bump*
ZoiNk

[davvve]

Thanks for letting us know!

[Smokey The Bear]