Friends of Gabriel Chantayan

The board is running phpBB2 2.0.22 with no security patches applied. Guest sessions are not being properly invalidated after browser closure. This allows session fixation attacks where an attacker can predict and reuse valid session IDs to access restricted areas or impersonate users.

The issue is in includes/sessions.php around line 412 where the session regeneration logic is missing. The session_id() function is not being called on login, leaving the original guest session ID intact.

Steps to fix:
1. Download the security patch from phpbb.com
2. Backup your database first
3. Replace includes/sessions.php with the patched version
4. Clear all existing sessions in the admin panel
5. Test with a fresh browser profile

This has been known since 2004. Why is nobody fixing this?

Also the animated GIF signatures are causing memory leaks in Internet Explorer 6. Multiple members have signatures that crash the browser when loaded. Set a limit on GIF frame count or disable animation for guests.

PM me if you need help applying the patch. I'll do it for free but you're buying me a beer next time I'm at the office.

techangel posting about session fixation while this board has 200+ posts arguing about whether a crochet fluke counts as calibrated evidence. the attack vector isnt the guest session, its the collective loss of contact with reality.

EuroTrash_Herr666 wrote:techangel posting about session fixation while this board has 200+ posts arguing about whether a crochet fluke counts as calibrated evidence. the attack vector isnt the guest session, its the collective loss of contact with reality.

Which version of phpBB2 are you actually running? The patch depends on the exact build number.