MyBB 1.0.3 - 'moderation.php' SQL Injection

source: https://www.securityfocus.com/bid/16538/info

MyBB is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input.

Successful exploitation can allow an attacker to bypass authentication and gain administrative access to a site, modify data, or exploit vulnerabilities in the underlying database implementation. Other attacks may also be possible.

Note that an attacker must have sufficient message moderation and merging privileges to exploit this vulnerability.

MyBB version 1.0.3 is reported to be vulnerable.

http://www.example.com/mybb/moderation.php?posts=[firstpid]|[secondpid]?[SQL]
&tid=[containertid]&action=do_multimergeposts&sep=hr