phpGB SQL Injection Vulnerability

phpGB is vulnerable to a SQL injection vulnerability.

The cause of the issue is that the bulletin board relies on the PHP magic_quotes_gpc directive to sanitize variables that are used in SQL queries.

If magic_quotes_gpc is not enabled, then it will be possible for attackers to mount SQL injection attacks through the gestbook. SQL injection may allow attackers to corrupt the database. It is also possible to exploit this issue to gain administrative guestbook privileges.


Privacy Statement
Copyright 2010, SecurityFocus