The vulnerabilities exist due to insufficient sanitation of user-supplied data in URI in the "update_whosonline_reg()" and "update_whosonline_guest()" functions within the "/includes/user_function.php" script. A remote attacker can send a specially crafted HTTP request to one of the following scripts and execute arbitrary SQL commands in application's database: checkuser.php, groups.php, index.php, login.php, quicklogin.php, register.php, Search.php, viewboard.php, viewtopic.php. Successful exploitation of the vulnerabilities may allow attacker to extract sensitive data from the application's database, and even get complete control over the application under certain conditions (such as insecure configuration of database and web servers).