Get support from Xavier Media
It is currently Sun Dec 08, 2013 12:02 pm

All times are UTC

Post new topic Reply to topic  [ 1 post ] 
Author Message
 Post subject: Security problem with phpBB
PostPosted: Thu May 21, 2009 2:49 pm 
Offline Admin Admin
Super VIP Member
Super VIP Member
User avatar

Joined: Tue Mar 15, 2005 4:37 pm
Posts: 1082
Location: Sweden
Points: 1500
We've just discovered a serious security issue found in all versions of phpBB. By default all registered users are allowed to edit their own posts and this opens up all phpBB forums to an advanced form of SEO spam :(

It's working like this:

1. A user registers and posts a couple of legitimate posts asking for help on various topics related to the forum. The forum owner will think it's the real deal.

2. After a couple of weeks (about 3 weeks in our cases) the user returns and edit their original posts filling them with spam links.

An edit of a forum post will not set any alert and will not show up in any way like for example a reply will do. Therefore this will go completely unnoticed as long as no other user reply to the post or the admin is going thru all old posts every now and then to check for spam since the post has already been checked when the admin replied to the post :(

This is a serious problem, but it's easy to fix: Just login to your forum admin page and remove all privileges for registered users to edit their own posts.

This fix will of course reduce the functionality of your forum, but for now there's no other fix.....

Xavier Media®
Join me at LinkedIn | Get your latest blog post in your signature you too

 Profile Send private message  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 1 post ] 

All times are UTC

Who is online

Registered users: No registered users

You cannot post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  

Portal » Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
SEO MOD © 2007 StarTrekGuide ]