I have just uncovered an exploit of the UBB Engine 6.5
Non-members can run a denial of service exploit by isssuing the following command repeatedly and directly through their browser.
<pre>http://www.yoursite.com/cgi-bin/ultimatebb.cgi?ubb=avatar_select;avatar_url=http://www.yoursite.com/ubb/blank.gif;start_with=60</pre>
Our server has been getting the snot kicked out of it for the past week we finally found the origin of the problem.
Try doing this on your own sites.
Modify the URL based on your CGI-BIN and NON-CGI-BIN configuration
UBB should make it the highest priority to fix this bug.
As for now all I can do is monitor my server logs or turn off Avatar usage on my site.
Pardon me if this has been covered, I just found this exploit running on my site and thought it best to post this here and now.
