bugtraq - Re: phpBB Code EXEC (v2.0.10)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20051128213036.B85830@zarathustra.linux666.com>
Date: Mon, 28 Nov 2005 21:35:31 +0100 (CET)
From: Ron van Daal <ronvdaal@....nl>
To: deane10@...global.net
Cc: bugtraq@...urityfocus.com
Subject: Re: phpBB Code EXEC (v2.0.10)

Version 2.0.10 ??? Did you also tried the -latest- phpBB ???

This issue has been reported multiple times and finally resolved over half a year ago. The last known code-injection bug regarding the hilighting code was fixed in phpBB version 2.0.16.

Grt,
  Ron

On Mon, 27 Nov 2005 deane10@...global.net wrote:

> Add these into the mod_security rules:
>
> SecFilterSelective ARG_highlight "(\x27|%27|\x2527|%2527)"
> SecFilterSelective THE_REQUEST "\x27|%27|\x2527|%2527"
>
> issue resolved...
>