An vulnerability has been identified in XMB, which can be exploited by malicious people to manipulate existing SQL queries.

The vulnerability is caused due to an input validation error in the registration processing. A malicious person can exploit this to inject arbitrary SQL code into the variables "$email1" and "$email2", which can result in disclosure of sensitive information - eg. retrieval of arbitrary users' password hashes.

Successful exploitation requires that "register_globals" has been enabled in "php.ini".

Solution
Upgrade to XMB 1.8 Final Edition SP1:
Further details available to Secunia VIM customers

Provided and/or discovered by
Binary Bugs

Original Advisory
http://www.bbugs.org/advisories/BB-2003-1-XMB

Deep Links
Links available to Secunia VIM customers