phpBB is "a high powered, fully scalable, and highly customizable open-source bulletin board package. phpBB has a user-friendly interface, simple and straightforward administration panel, and helpful FAQ. Based on the powerful PHP server language and your choice of MySQL, MS-SQL, PostgreSQL or Access/ODBC database servers, phpBB is the ideal free community solution for all web sites."
An SQL injection vulnerability exists in the uid field sent to phpBB, this would allow a remote attacker to insert malicious SQL statements into existing ones.
Credit:
The information has been provided by jocanor jocanor
This URL shows the information for the user with the uid = 2 (the uid is a number assigned to users in phpBB). The content of the 'u' variable isn't filtered for malicious contents.
An attacker could inject arbitrary SQL commands into the system's database.
