[41218] in bugtraq
Re: phpBB 2.0.18 SQL Query problem
daemon@ATHENA.MIT.EDU (max@jestsuper.pl)
Tue Nov 15 19:34:40 2005
Date: 15 Nov 2005 22:52:41 -0000
Message-ID: <20051115225241.5845.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: max@jestsuper.pl
To: bugtraq@securityfocus.com
>This isn't a security problem. Why post it to Bugtraq?
No? Are you sure? For example can you see path.
Good script have limits for inputs like vb.
phpbb don't have.
result:
Fatal error: Allowed memory size of 8388608 bytes exhausted (tried to allocate 1746401 byt
es) in /www/2018/phpBB2/includes/functions_search.php on line 27
it is path disclosure
or can you see sql errors
good php script isn't dependant of php env.
> Did you reported this to the PhpBB bugtracker?
yes. no response.
