This is all fine and dandy but do you realize how much work is involved in pining something like that down.
I have full access to my server, but I also work on UBB sites that do not allow me access to the internal server functions and logs. In fact most people UBB customers will not have that level of access on their host servers.
Granted any CGI script is exploitable but wouldn’t it be prudent to update the UBB script to that these internal functions only be accessed only by the UBB script and not from posting a URL? Addressing flaws in the system that can be bandwidth and CPU intensive will either make or break this product. The creeps out there have now discovered this exploit. What is UBB going to do about it?
Saying that they can initiate a denial of service against this site by exploiting UBB code isn’t a very good selling point and not really an acceptable response to someone who has spent a great deal of money on your product over the years.
