CVE-2003-1215

An attacker who is already a group moderator sends a crafted `$HTTP_POST_VARS['members']` (or `pending_members`) array to `groupcp.php`. The loop concatenates each array element into `$sql_in` without any sanitization [ref_id=1]. By injecting a value such as `1) or 1=1/*`, the attacker causes the DELETE query to remove all users from the target group, or the moderator-check query to return unintended results, enabling unauthorized group management actions [ref_id=1].

The vulnerability resides in `groupcp.php` of phpBB 2.0.6 and earlier. The `$sql_in` variable is built by concatenating user-supplied array values (`$members`) without sanitization, then used directly in SQL queries [ref_id=1]. The two critical queries are a SELECT on `AUTH_ACCESS_TABLE` and `USER_GROUP_TABLE` to verify moderator status, and a DELETE on `USER_GROUP_TABLE` that removes group members [ref_id=1].

The advisory recommends wrapping each `$members[$i]` value with `intval()` in the loop that builds `$sql_in` [ref_id=1]. Specifically, replace `$sql_in .= ( ( $sql_in != '' ) ? ', ' : '' ) . $members[$i];` with `$sql_in .= ( ( $sql_in != '' ) ? ', ' : '' ) . intval($members[$i]);` [ref_id=1]. This forces every array element to an integer, eliminating the possibility of injecting arbitrary SQL strings into the IN clause.