CVE-2007-6667

Vulnerability

The faq.php script in MyPHP Forum 3.0 and earlier contains a SQL injection vulnerability in the id parameter. The parameter is directly interpolated into a SQL query without sanitization: SELECT * from $db_faq WHERE id='$id'. This code path is reachable when the action parameter is set to view and id is not empty. The vulnerability requires magic_quotes_gpc to be disabled on the server. The member.php vector is a separate issue covered by CVE-2005-0413 [1].

Exploitation

An unauthenticated attacker can exploit this by sending a crafted HTTP GET request to faq.php with action=view and a malicious id parameter. For example, the payload -1' union select 1,concat(username,0x3a,password),3 from {table_prefix}_member where uid=1/* extracts usernames and passwords from the _member table. The attacker must know or guess the table prefix (commonly nb_) [1].

Impact

Successful exploitation allows the attacker to execute arbitrary SQL commands, leading to disclosure of sensitive data such as user credentials. This can result in full compromise of user accounts and potentially the entire forum database. The attacker gains read access to all tables, and could potentially modify or delete data depending on database permissions [1].

Mitigation

No official patch has been released for this vulnerability. The software appears to be end-of-life. As a workaround, enabling magic_quotes_gpc (though deprecated) may prevent injection, but proper input validation or parameterized queries are recommended. This CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog [1].