Re: AzzCoder => PNphpBB (Latest) Remote File Include

["Carsten Eilers" <ceilers-lists () gmx de>]

Hi str0ke,

str0ke schrieb am Thu, 21 Sep 2006 11:16:20 -0500:

> The vulnerability is in version 1.2g and below.

I know (now):
After azzcoder send me a direct mail this morning I 
looked at the version he tested, which is 1.2g.
His "(Latest)" in the subject leads me to the actual
version, 1.2i, which is not vulnerable.

My answer to him was send also to Bugtraq, but it
seems as if it was to late to stop/change my previous
mail.

> Source code :
> http://prdownloads.sourceforge.net/pnphpbb2/

Thats a funny solution from PNphpBB: If I want to
download from their Homepage (with the link at the
top right) they send me to
<http://noc.postnuke.com/frs/?group_id=374>
instead of their own Sourceforge-Page. And there
is no other version than 1.2i.

After azzcoder send me the link to the Sourceforge-
Download I found the older versions. 
But if I'm right than there is no direct link from 
<http://www.pnphpbb.com/> to Sourceforge, so I would
never looked there.

Regards
  Carsten

-- 
Dipl.-Inform. Carsten Eilers
IT-Sicherheit und Datenschutz

<http://www.ceilers-it.de>