CVE-2007-2339

This exploit demonstrates a SQL injection vulnerability in Phorum 5.1.20 due to improper sanitization of array input in the `phorum_db_user_get` function. The PoC uses a crafted HTML form to inject malicious SQL via the `recipients` parameter.

This is a writeup describing a SQL injection vulnerability in Phorum 5.1.20. It demonstrates how an attacker can exploit insufficient input sanitization to inject malicious SQL queries, specifically by creating a group with a name containing a single quote.

This exploit demonstrates a SQL injection vulnerability in Phorum's banlist deletion functionality due to insufficient input sanitization. The PoC triggers a SQL syntax error by injecting 'OR' into the 'delete' parameter, confirming the vulnerability.