phpBB Profile.PHP SQL Injection Vulnerability

Bugtraq ID:	8994
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 08 2003 12:00AM
Updated:	Nov 08 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to jocanor jocanor <[email protected]>.
Vulnerable:	phpBB Group phpBB 2.0.5 phpBB Group phpBB 2.0.4 phpBB Group phpBB 2.0.3 phpBB Group phpBB 2.0.2 phpBB Group phpBB 2.0.1 phpBB Group phpBB 2.0 .0
Not Vulnerable:	phpBB Group phpBB 2.0.6

phpBB Profile.PHP SQL Injection Vulnerability

A SQL injection vulnerability has been reported for phpBB systems.

phpBB, in some cases, does not sufficiently sanitize user-supplied input, which is used when constructing SQL queries to execute on the underlying database. As a result, it is possible to manipulate SQL queries. This may allow a remote attacker to modify query logic or potentially corrupt the database.

SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.

phpBB Profile.PHP SQL Injection Vulnerability

The following proof of concept has been supplied:
http://www.example.com/profile.php?mode=viewprofile&u='[sqlcode]

phpBB Profile.PHP SQL Injection Vulnerability

Solution:
This issue is addressed in recent versions of the software. Users are advised to upgrade to version 2.0.6 or later.

phpBB Profile.PHP SQL Injection Vulnerability

References:

• phpBB Homepage (phpBB)
  
• Re: sql injection in phpbb (Marius Kaase )
  
• sql injection in phpbb (jocanor jocanor )