The latest version of phpBB is 2.0.22. Anyone using any version less than that is urged to upgrade.
As for the posted exploit, it is invalid. usercp_register.php has always had the following code in it:
if ( !defined('IN_PHPBB') )
{
die("Hacking attempt");
exit;
}
It has been there since phpBB 2.0.0; it makes your report invalid because you are unable to set the defined variable in order to bypass this check.
We urge people reporting issues to use our security tracker, http://www.phpbb.com/security/, or e-mail security@xxxxxxxxx with any issues they find.
NeoThermic
phpBB Support Team, Audit Team and Incident Investigation Team Leader.
