Description
An SQL injection vulnerability exists in bb_admin.php of miniBB. The whatus parameter of a searchusers2 action is inserted into an SQL statement without sanitization, so a crafted value changes the meaning of the query.
Impact
An attacker can execute arbitrary SQL commands against the forum database and read forum member records, including stored password hashes, which can lead to full administrative access.
Solution
Escape or bind the whatus parameter before it reaches the query. Upgrade to miniBB 3.0.1 or later.