Description
A SQL injection vulnerability exists in nuBoard 0.5 through the ssid parameter in threads.php. The parameter is not properly sanitized before being used in SQL queries.
Impact
Attackers can inject arbitrary SQL commands to extract all data from the forum database, including user credentials, private messages, and forum configuration.
Solution
Use parameterized queries for the ssid parameter. Upgrade to a maintained forum software.