Recently a serious exploitable issue was discovered in PHP (the scripting language in which phpBB, IPB, vB, etc. are written) versions prior to 4.3.10. The problematical functions include unserialize and realpath. phpBB (along with a great many other scripts including IPB, vB, etc.) use these two functions as a matter of course.

It has come to our attention that code has now been released which uses this exploit in PHP to obtain confidential information in phpBB. Such information includes data contained in phpBB's config.php file. We therefore recommend the following:

1) If you maintain your own server be sure to upgrade to the newest available release of PHP (both versions 4 and 5). Be aware that at this time phpBB 2.0.x has problems functioning under PHP5 without modification.

2) If you pay for hosting ensure you hosting provider has upgraded thier installation of PHP (again remember that phpBB 2.0.x and other scripts will not function under PHP5 without modification).

Please do not submit this PHP issue to our security tracker, it is beyond our control. Fixed versions of PHP do exist and as above we encourage you to ensure your system is running such a version. Equally please examine any "hacking" issues you have carefully to ensure they are not caused by this PHP problem (rather than phpBB). Remember, this is not a phpBB exploit or problem, it's a PHP issue and thus can affect any PHP script which uses the noted functions.

Nema razlike izmedju losih admina bez obzira koji sistem administriraju.

degojs:
Slažem se. I to što neki koriste skoro isključivo komandnu liniju ne čini ih boljim.

littleboy
Ko je rekao da ih cini boljim ?

Komandna linija znantno olaksava posao

sto windozeri nikad nece razumjeti.

Leftist: 
Dakle koristim Linux jer mi je lepo. Kome nije lepo, zabole me!

Gojko Vujovic: Komentiraš jednu liniju u phpBB i rešio si problem. Čik uradi to u windowsu.

Dragi Tata: Dakle koristim Windows jer mi je korisno. Ko traži lepotu u operativnom sistemu može da koristi šta hoće.

degojs: 
Inače ste čuveni po odličnim GUI alatima, pa te potpuno razumem.

A Note on Security in PHP

[31-Dec-2004] PHP is a powerful and flexible tool. This power and flexibility comes from PHP being a very thin framework sitting on top of dozens of distinct 3rd-party libraries. Each of these libraries have their own unique input data characteristics. Data that may be safe to pass to one library may not be safe to pass to another.

A recent Web Worm known as NeverEverSanity exposed a mistake in the input validation in the popular phpBB message board application. Their highlighting code didn't account for double-urlencoded input correctly. Without proper input validation of untrusted user data combined with any of the PHP calls that can execute code or write to the filesystem you create a potential security problem. Despite some confusion regarding the timing of some unrelated PHP security fixes and the NeverEverSanity worm, the worm didn't actually have anything to do with a security problem in PHP.
...

dinke: php tim nema ama baš nikakve veze sa phpbb forumom, tako da tvoja primedba apsolutno ne stoji.

Lično se bavim ničim vezano za ms, ali zamisli da neko napravi bušan forum software u asp-u, neko ga hakuje a vlasnik tog forum software-a okrivi microsoft. Eto to je to što se ovde dešava.

dinke:
Lično se bavim ničim vezano za ms, ali zamisli da neko napravi bušan forum software u asp-u, neko ga hakuje a vlasnik tog forum software-a okrivi microsoft. Eto to je to što se ovde dešava.

This worm does not have enough similarities with Santy, thus we renamed
this version to PhpInclude.Worm. It targets ANY .PHP page/script vulnerable to a remote file inclusion (programming) flaw [these vulnerabilities are independent from the PHP version, they result from common coding mistakes.