Re: Remote File Include In phpBB-2.0.19

[neothermic@phpbb.com]

The latest version of phpBB is 2.0.22. Anyone using any version less than that 
is urged to upgrade.

As for the posted exploit, it is invalid. usercp_register.php has always had 
the following code in it:
if ( !defined('IN_PHPBB') )
{
        die("Hacking attempt");
        exit;
}

It has been there since phpBB 2.0.0; it makes your report invalid because you 
are unable to set the defined variable in order to bypass this check.

We urge people reporting issues to use our security tracker, 
http://www.phpbb.com/security/, or e-mail security@phpbb.com with any issues 
they find.

NeoThermic
phpBB Support Team, Audit Team and Incident Investigation Team Leader.