phpBB2 Gender Mod 1.1.3 - SQL Injection

2002-07-29T00:00:00
ID EXPLOITPACK:E3630CEEEEA9CF12440A9A014FF1D399
Type exploitpack
Reporter langtuhaohoa caothuvolam
Modified 2002-07-29T00:00:00

Description

phpBB2 Gender Mod 1.1.3 - SQL Injection

                                        
                                            source: https://www.securityfocus.com/bid/5342/info

phpBB2 is an open-source web forum application that is written in PHP and backended by a number of database products. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.

Gender Mod is a modification for phpBB2 which allows the association of a gender with a given user profile. A SQL injection vulnerability has been reported in this mod. A remote user may subvert the SQL statement used to update their user profile, possibly gaining administrative access to the system. 

"0, user_level = 1 "