-----BEGIN-----

URL: http://www.o2php.com

Oxygen Bulletin Board versions <= 1.1.3 are vulnerable to sql injection


in multiple places.

1. Misc.php
There is and sql injection vulnerability in the 'username' fields in

the lost password action.

POC: /misc.php?action=lostpw&username='&email=&submit=Ap pliquer

2. Forumdisplay.php
There is and sql injection vulnerability in the 'fid' fields in the

forum display.

/forumdisplay.php?fid='

Suggestions: Turn magic_quotes_gpc on in your server.

11 November 2005 - Vulnerabilities found
12 Nobember 2005 - Vendor Contacted
12 November 2005 - Public Disclosure
-----END-----

Author Comments: I need some help in contacting the vendor as they are

french, and won't understand my message much. A big shout out to

everyone at GSO!