lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: 15 Nov 2005 22:52:41 -0000
From: max@...tsuper.pl
To: bugtraq@...urityfocus.com
Subject: Re: phpBB 2.0.18 SQL Query problem


>This isn't a security problem. Why post it to Bugtraq?
No? Are you sure? For example can you see path. 
Good script have limits for inputs like vb.

phpbb don't have.

result:
Fatal error: Allowed memory size of 8388608 bytes exhausted (tried to allocate 1746401 byt
es) in /www/2018/phpBB2/includes/functions_search.php on line 27

it is path disclosure

or can you see sql errors

good php script isn't dependant of php env.

> Did you reported this to the PhpBB bugtracker?

yes. no response.


Powered by blists - more mailing lists