phpBB 2.0.x - 'profile.php' SQL Injection

Author: JOCANOR
type: webapps
platform: php
port: 
date_added: 2003-11-08 
date_updated: 2012-12-13 
verified: 1 
codes: OSVDB-4270 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/8994/info

A SQL injection vulnerability has been reported for phpBB systems.

phpBB, in some cases, does not sufficiently sanitize user-supplied input, which is used when constructing SQL queries to execute on the underlying database. As a result, it is possible to manipulate SQL queries. This may allow a remote attacker to modify query logic or potentially corrupt the database.

SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.

http://www.example.com/profile.php?mode=viewprofile&u='[sqlcode]