deluxe89 and the Security-Project Team has reported some vulnerabilities in the JGS-Portal module for Woltlab Burning Board, which can be exploited by malicious people to conduct SQL injection attacks.

Certain input isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Examples:
http://[host]/jgs_portal.php?anzahl_beitraege=[code]
http://[host]/jgs_portal_statistik.php?meinaction=mitglieder&month=1&year=1[code]
http://[host]/jgs_portal_statistik.php?meinaction=themen&month=1&year=1[code]
http://[host]/jgs_portal_statistik.php?meinaction=beitrag&month=1&year=1[code]
http://[host]/jgs_portal_beitraggraf.php?month=1&year=1[code]
http://[host]/jgs_portal_viewsgraf.php?jahr=1&monat=1&tag=1[code]
http://[host]/jgs_portal_themengraf.php?month=1&year=1[code]
http://[host]/jgs_portal_mitgraf.php?month=1&year=1[code]
http://[host]/jgs_portal_sponsor.php?id=[code]
The "Accept-Language" HTTP header passed to "jgs_portal_log.php"

It is also possible to disclose the full path to certain scripts by accessing them directly.

The vulnerabilities have been reported in version 3.0.2 and prior. Other versions may also be affected.

Solution
The vendor reports that the vulnerabilities have been fixed in version 3.0.4.

Provided and/or discovered by
deluxe89 and the Security-Project Team

Changelog
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers