Description
DeluxeBB 1.07 and earlier allows remote attackers to bypass SQL injection protection mechanisms via the login variable and certain other variables, by using lowercase "union select" or possibly other statements that do not match the uppercase "UNION SELECT."
References
- 1254 third-party-advisory
- 19052 vdb-entry
- 21116 third-party-advisory
- 20060718 Advisory : DeluxeBB mutiple vulnerabilities mailing-list
- ADV-2006-2879 vdb-entry
- 20060718 DeluxeBB mutiple vulnerabilities mailing-list