SQL injection vulnerability in modules/members.php in IceBB before 1.0-rc9.3 allows remote attackers to execute arbitrary SQL commands via the username parameter in a members action to index.php, related to an incorrect protection mechanism in the clean_string function in includes/functions.php.
| Software | From | Fixed in |
|---|---|---|
| icebb / icebb | 1.0-rc9 | 1.0-rc9.x |
| icebb / icebb | 1.0-rc9.1 | 1.0-rc9.1.x |
| icebb / icebb | 1.0-rc9.2 | 1.0-rc9.2.x |