Web Hosting Talk : Web Hosting Main Forums : Web Hosting : Phpbb Exploits?? Am I missing something

[ebizcraftsman]

Hello,

I have read several posts about an exploit with the phpbb forums. Is there something new out there I need to know about. Also what kind of exploit.. Access to your server, Damage to forums??

Thanks and please let me know.

[ReasonSinger]

Go to the source and read about the changes.

http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=302011

The latest one is another highlight bug that was inadequately addressed the first time around. Those types of exploits allow people to use the insecure version to grab remote files and execute them on the server. In our experience, UDP flooders and IRC junk is what is usually uploaded.

[BaselineAce]

If you're aiming for a free forum, SMF is your man.

[Jalberts]

Do you have a link for SMF?

Thanks.

[neb1211]

I believe that the url is http://www.simplemachines.org

[Cirtex]

Just keep your phpBB updated at all times.

[cartika-andrew]

Originally posted by BaselineAce
If you're aiming for a free forum, SMF is your man.

SMF is a great app - but - still a little problematic for my liking.

Migrating URL's causes all sorts of DB issues - and the DB cleanup utility doesnt always work too well (though overall, this is a pretty nice utility)

Also - I really dont like how there isnt an option to turn off error reporting to the DB - as somthing as simple as password hack attempts can fill up the DB with junk. We had a users DB jump from 5 MB to 300 MB - and really - there was no way to prevent this except to comment out the error reporting....

Having said all this - its a great app - growing strong - great templating features - and not nearly as well known or used as phpbb - which ultimately means less vulnerabilities are found

[catfished]

Originally posted by BaselineAce
If you're aiming for a free forum, SMF is your man.

Very true, SMF is the up and coming winner.

[Scotty_B]

Originally posted by CartikaHosting
Also - I really dont like how there isnt an option to turn off error reporting to the DB - as somthing as simple as password hack attempts can fill up the DB with junk. We had a users DB jump from 5 MB to 300 MB - and really - there was no way to prevent this except to comment out the error reporting....

There is, it's in Edit Features & Options.

[Fulk]

Hosts Ban phpBB As Security Issues Persist

[Leetservs]

I'd reccomend just switch forums. Possibly INVISION if you liked the phpBB type panel.

[magick]

yes phpbb is popular so its vulnerable and if you dont update every morning to make sure youre up to date, you are a target. ive had two forums hacked on phpbb and as much as i like it i wont use it again cause i dont have the time to keep it updated properly.

[cartika-andrew]

I'd reccomend just switch forums. Possibly INVISION if you liked the phpBB type panel.

As a policy, we avoid any application that defaults to p_connect ON.

yes phpbb is popular so its vulnerable and if you dont update every morning to make sure youre up to date, you are a target. ive had two forums hacked on phpbb and as much as i like it i wont use it again cause i dont have the time to keep it updated properly.

We had a few sites compromised with these latest exploits - however, its not worth giving up on phpBB - excellent application, well supported, the community responds immediately to any exploits and issues patches.

On that note - suscribe to the phpBB mailing list and you will receive immediate notification of any updates/patches

[layer0]

Originally posted by Leetservs
I'd reccomend just switch forums. Possibly INVISION if you liked the phpBB type panel.

If you're talking about IPB 1.3, that actually has some vulnerabilites, too.

-GSV

[SSilver2k2]

i like PunBB. its very simple, and nice.