Re: PhpBB<=2.0.10 (groupcp.php) Remote File Include Vulnerability

[neothermic@xxxxxxxxx]

phpBB 2.0.10 was released on the 16th of July 2004, making it well over two 
years old. We are currently on version 2.0.21.

A quick check of the indicated file with the 2.0.10 tags in CVS shows that it 
is not vulnerable to this attack. Line 24 (which is the second line past the 
comment block) is $phpbb_root_path = './';
(See: 
http://phpbb.cvs.sourceforge.net/phpbb/phpBB2/groupcp.php?revision=1.58.2.21&view=markup&pathrev=release_2_0_10
 )

Walking backwards through the CVS versions shows that this has never been 
possible with any version of groupcp.php from 2.0.0 to latest.

I would encourage anyone finding a possible vulnerability in phpBB to report it 
properly at our security tracker ( http://www.phpbb.com/security/ ), or e-mail 
it to security at phpbb.com

NeoThermic
phpBB Support Team, Audit Team and Incident Investigation Team Member