For any of you running a phpBB based setup, if there was one idea I could get across to you, underlined, bolded and with 17 exclamation marks is make sure you set register_globals to off.

Now that I have gotten that out of the way, heise Security has a short article up discussing the matter in a bit more detail.