CVE-2001-1482

Step 1: Payload Delivery: The attacker crafts a malicious URL containing a specially crafted value for the $sortby parameter in bb_memberlist.php. This value includes SQL injection code.

Step 2: Request Submission: The attacker sends the malicious URL to the vulnerable phpBB forum.

Step 3: Server-Side Processing: The phpBB server receives the request and executes the bb_memberlist.php script.

Step 4: Query Construction: The script constructs an SQL query using the attacker-supplied $sortby value without proper sanitization.

Step 5: SQL Injection: The malicious SQL code injected by the attacker is executed as part of the database query.

Step 6: Data Manipulation: Depending on the injected SQL code, the attacker can perform actions such as retrieving sensitive data (e.g., usernames, passwords), modifying existing data, or even gaining administrative access to the forum.

The vulnerability stems from insufficient input validation of the $sortby variable within the bb_memberlist.php script. The script directly incorporates user-supplied input from the $sortby variable into SQL queries without proper sanitization or escaping. This allows an attacker to inject malicious SQL code, manipulating the database queries to extract, modify, or delete data. The root cause is a lack of parameterized queries or prepared statements, which would have prevented the injection of malicious SQL code. The script trusts the user-provided input without validating its format or content, leading to the vulnerability.