Woltlab Burning Board Search.PHP SQL注入漏洞

Woltlab Burning Board是一款基于PHP的WEB应用程序。

Woltlab Burning Board不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。

问题是’Search.PHP’脚本对用户提交的WEB参数缺少过滤，提交恶意脚本代码作为参数数据，可导致获得敏感信息。

Woltlab Woltlab Burning Board Lite 1.0.2
WoltLab Burning Board Lite 1.0.2
WoltLab Burning Board Lite 1.0.1 e
WoltLab Burning Board Lite 1.0 .0
Woltlab Burning Board 2.7
Woltlab Burning Board 2.6
Woltlab Burning Board 2.5
Woltlab Burning Board 2.4
Woltlab Burning Board 2.3.6
Woltlab Burning Board 2.3.5
Woltlab Burning Board 2.3.4
Woltlab Burning Board 2.3.3
Woltlab Burning Board 2.3.1
Woltlab Burning Board 2.2.2
Woltlab Burning Board 2.2.1
Woltlab Burning Board 2.1.6
Woltlab Burning Board 2.0 RC2
Woltlab Burning Board 2.0 RC1
Woltlab Burning Board 2.0 beta 5
Woltlab Burning Board 2.0 beta 4
Woltlab Burning Board 2.0 beta 3

目前没有解决方案提供：

<a href=“http://www.woltlab.de/products/burning_board/index_en.php” target=“_blank”>http://www.woltlab.de/products/burning_board/index_en.php</a>