source: http://www.securityfocus.com/bid/5673/info phpGB is vulnerable to a SQL injection vulnerability. The cause of the issue is that the bulletin board relies on the PHP magic_quotes_gpc directive to sanitize variables that are used in SQL queries. If magic_quotes_gpc is not enabled, then it will be possible for attackers to mount SQL injection attacks through the gestbook. SQL injection may allow attackers to corrupt the database. It is also possible to exploit this issue to gain administrative guestbook privileges. Use an existing administrator name (default is admin) and use the following password: "' OR 'a'='a"
Related ExploitsTrying to match CVEs (1): CVE-2002-1482
Trying to match OSVDBs (1): 10111
Other Possible E-DB Search Terms: phpGB 1.x, phpGB
|2002-09-09||phpGB 1.1 - HTML Injection||ppp-design|
|2002-09-09||PHPGB 1.1/1.2 - PHP Code Injection||ppp-design|