Geeky Thread: phpBB 3.x vulnerabilities

This does not apply to the .org as we don't use phpBB here.

I've just heard that there are a couple of vulnerabilities for phpBB 3.x out at the moment.

These vulnerabilities involve the membership lists, and PM attachments. My advice to anyone running a phpBB 3.x based forum to disable membership lists, and attachments to PM's.

These vulnerabilites (from my quick look) are being listed as low priority. However, they are actually being used as a stepping stone. Comprimise the server running phpBB for use later. It appears from the network graphs I've seen that these comprimised servers will be used for some form of DDoS once they've reached critical mass.

So any admins out there, keep an even closer eye on your phpBB installations...