Release Date: 2003-12-30
Critical: Less critical
Impact: Security Bypass
Where: From remote
Software: phpBB 2.x
Description:
Zarath has reported a vulnerability in phpBB, allowing malicious moderators to manipulate SQL queries.
The problem is that certain parameters aren't properly verified before deleting group members. This can be exploited by moderators to inject arbitrary SQL code.
Solution:
Only grant moderator privileges to trusted users.
Provided and/or discovered by:
Zarath
Source: Secunia