TinyBB Version 1.2 is vulnerable to SQLi. The exploit can be performed by appending ' or 'a'='a to the profile ID parameter in the URL.
This exploits works on tinyBB <= 0.3. It includes a Remote File Include vulnerability, a Local File Include vulnerability, and a SQL injection vulnerability. The Remote File Include vulnerability allows an attacker to include a remote file on the vulnerable server. The Local File Include vulnerability allows an attacker to include a local file on the vulnerable server. The SQL injection vulnerability allows an attacker to inject malicious SQL code into the vulnerable server.
The vulnerability exist in /inc/viewthread.php file at line 3. As you can see below the $_GET['post'] parameter isn't properly sanitized. A remote user can access these files to cause the system to display an error message that indicates the installation path.
Services By CQR