Full Path Disclosure - Array.

http://www.minibb.com/forums/index.php?action=stats&top=1&days=60&lst[]
Fatal error: Unsupported operand types in /home/minibb/public_html/forums/bb_func_stats.php on line 37

http://www.minibb.com/forums/index.php?action=stats&top[]
Fatal error: Unsupported operand types in /home/minibb/public_html/forums/bb_func_stats.php on line 37

http://www.minibb.com/forums/index.php?action=userinfo&user[]
Fatal error: Unsupported operand types in /home/minibb/public_html/forums/bb_func_usernfo.php on line 11

http://www.minibb.com/forums/index.php?action=checker&step=editsettings&isNew[]
Fatal error: Unsupported operand types in /home/minibb/public_html/forums/addon_checker.php on line 860

http://minibb.org/minibb-test.php?action=vthread&forum=3&topic=695&page[]
Fatal error: Unsupported operand types in /data/minibbtest/minibb-test.php on line 70

http://minibb.org/minibb-test.php?action=vthread&forum=3&topic[]
Fatal error: Unsupported operand types in /data/minibbtest/minibb-test.php on line 69

http://minibb.org/minibb-test.php?action=vthread&forum[]
Fatal error: Unsupported operand types in /data/minibbtest/minibb-test.php on line 67

hello.. yes, but you're using topic and forum as arrays. So what kind of behavior do you expect?

I must agree this bug exists, however there will be still no solution for it and we will release it only when the new release of miniBB comes out next year. Basically it would be needed to fix each and every file where such integer variable setting happens, and there are a lot of these files.

In general on each "normal" hosting all PHP errors must be supressed in the configuration so most likely you won't even see such error reporting.

I have checked some major scripts like punBB or WordPress or vBulletin (and/or their add-ons) and it appears all of them can be 'vulnerable' because of this issue as well.

First I thought it is a PHP bug because it is strange that PHP which works so transparently with the operand types, and it shuts down on such simple confusion.

However to avoid confusion of the users I would mention this is not a critical bug and even knowing direct path to the scripts on the server means nothing until you have access to this path (and I suppose only folder's owner can have such access, else we could call it an insecure hosting).

This bug was hopefully fixed in the miniBB 2.2. All official add-ons were updated as well.