Fix for phpbb 2.0.18 query exploit

[BlackRaven]

Fix for Phpbb 2.0.18 Search Explot/Bug

#in common.php find

// Define some basic configuration arrays this also prevents

#Before Add the following

foreach (array('POST', 'GET', 'REQUEST') as $gpc)
{
$gpcc = 'HTTP_'.$gpc.'_VARS';
if ($GLOBALS[$gpcc])
{
foreach ($GLOBALS[$gpcc] as $index => $ppp)
{
if (strlen($ppp) > 1024*1024)
{
$GLOBALS[$gpcc][$index] = substr($ppp,0,1024*1024-1).' ';
}
}
}
}

[rogerd]

Thanks for posting, BR - is there any word on an official patch?

[BlackRaven]

i had this posted on phpbb sercurity & bug tracker since Nov 20 and still no info on any official patches.

[rogerd]

Hmmm, if this flaw is that old someone is bound to start exploiting it.

[goldminer]

This is scary!
googling phpbb 2.0.18 query exploit you will find everything!
But fast searching phpbb.com : nothing!

I don't understand, if someone could explain/clarify, that would be great!

[encyclo]

i had this posted on phpbb sercurity & bug tracker since Nov 20 and still no info on any official patches.

If I understand the problem correctly, there won't be an urgent patch as it is not an urgent bug. From the summary on a security-related site discussing the bug:

SecurityRisk : Low
Remote Exploit : No
Local Exploit : No
Exploit Given : No

The report was minimized on Bugtraq and elsewhere. At worst it appears to reveal the installation path or maybe an SQL error - but there is no accompanying weakness to exploit. Yes it theoretically would a good idea to limit the size of an SQL query for the next version of pbpBB, but I doubt they will act for this bug alone.

Of course if someone finds a way of exploiting this weakness in the code, then it might become more urgent to create a patch.