security issue

[timbercrawler]

someone posted this at my forums today:

http://timbercrawler.com/bb/phpBB2/viewtopic.php?t=2246

is this the same issue as this?

http://www.phpbb.com/phpBB/viewtopic.php?t=135116

If not, does anyone know if a fix is available or in the works for this? I know I can delete this post through phpMyAdmin with no trouble as there is no script to stop it but what the heck? I can't delete or edit this post from the boards as admin (says invalid_sessionid) and if i click reply it logs me out. i tried to contact the poster but he split the scene in a hurry. Thanks for any help, this just pisses me off.

[DiamondBack]

It is the same issue and if you read, there is an unofficial third party fix in there.

Use it at your own risk.

[timbercrawler]

Well IF it is the same issue - doesn't that mean if I install the 2.0.7 patch files it will be taken care of? I won't install 3rd party stuff until I have time to go over it line by line. Will 2.0.7 fix this? Thanks.

[DiamondBack]

It has not been addressed yet by phpBB. So no, 207 is not a fix.

[darlin001]

Well, I thought that this exploit was not so serious, according to phpBB Devs. Turns out that the Devs could be wrong, or in denial? These exploits do work, even on 2.07a.

[timbercrawler]

Exactly. if someone chimes in that they are working on it I'd feel better I am way to busy to look into it myself, I have a web firm to run. It looks like this is session variable related ad I know I have tackled this in shopping cart script. if it is the same idea it is a PITA to resolve.

[darlin001]

is this the same issue as this?

http://www.phpbb.com/phpBB/viewtopic.php?t=135116

No, this affects all newer versions too. That post is 6 months old.
They failed to mention that you can also delete any post on a forum as well.