vendor:
phpBB
by:
RusH security team
5.5
CVSS
MEDIUM
SQL Injection
89
CWE
Product Name: phpBB
Affected Version From: phpBB version <=2.06
Affected Version To: phpBB version <=2.06
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
2003
r57phpbb.pl – phpBB v<=2.06 search_id sql injection exploit (POC version)
This is a proof-of-concept exploit for a SQL injection vulnerability in phpBB version <=2.06. By manipulating the search_id parameter, an attacker can execute arbitrary SQL statements. The exploit retrieves the MD5 hash for a user with a specific user_id.
Mitigation:
Upgrade to a newer version of phpBB that is not affected by this vulnerability.