Secunia

TurkishWarriorr has discovered a vulnerability in Fully Modded phpBB, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed to the "k" parameter in kb.php (when "mode" is set to "article" and "page_num" is set) is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation allows e.g. retrieving administrator usernames and password hashes, but requires knowledge of the database table prefix.

The vulnerability is confirmed in version 80220. Other versions may also be affected.

Solution
Edit the source code to ensure that input is properly sanitised.

Provided and/or discovered by
TurkishWarriorr

Changelog
Further details available in Customer Area

Original Advisory
http://milw0rm.com/exploits/5243

Deep Links
Links available in Customer Area