bugtraq - Re: phpBB 2.0.18 SQL Query problem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 15 Nov 2005 22:52:41 -0000
From: max@...tsuper.pl
To: bugtraq@...urityfocus.com
Subject: Re: phpBB 2.0.18 SQL Query problem


>This isn't a security problem. Why post it to Bugtraq?
No? Are you sure? For example can you see path. 
Good script have limits for inputs like vb.

phpbb don't have.

result:
Fatal error: Allowed memory size of 8388608 bytes exhausted (tried to allocate 1746401 byt
es) in /www/2018/phpBB2/includes/functions_search.php on line 27

it is path disclosure

or can you see sql errors

good php script isn't dependant of php env.

> Did you reported this to the PhpBB bugtracker?

yes. no response.