Executive brief
LayerBB, a forum software platform, contains a security flaw in its search functionality. An unauthenticated attacker can exploit this to run unauthorized database commands, potentially leading to the theft of sensitive user data or administrative information. This could result in a full compromise of the forum's database and loss of user privacy.
Technical details
A SQL injection vulnerability exists in LayerBB version 1.1.4 and below due to improper neutralization of special elements in the 'search_query' parameter. The flaw is located in /search.php, where user input provided via a POST request is concatenated into a database query without sufficient sanitization. An unauthenticated remote attacker can exploit this by sending crafted SQL payloads, such as those utilizing CASE WHEN statements, to perform boolean-based or time-based blind SQL injection. This allows for the extraction of sensitive data from the underlying database. Public exploit code is available, confirming the vulnerability's exploitability.
Affected products
- LayerBB LayerBB 1.1.4 and earlier
Timeline
- 2021-02-19: other: Vulnerability discovered by researcher
- 2021-02-24: disclosed: Exploit published on Exploit-DB
- 2026-05-16: advisory: CVE published and NVD record created