CVE-2026-48613: SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration, allowing execution of arbitrary SQL queries

Synopsis

SQL injection vulnerability in phpBB allows an authenticated attacker to execute arbitrary SQL queries against the forum database during a profile field migration operation. The vulnerability is reachable over the network but requires a low-privilege account, victim interaction, and favorable environmental conditions to exploit. Successful exploitation reads sensitive data from the database, modifies stored records, and degrades service availability. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable phpBB endpoint is exposed over the network, so an attacker must be able to reach it via HTTP/HTTPS from a remote host.

• AuthenticationRequired

  A low-privilege forum account is sufficient; no administrative credentials are needed, but some authenticated session must exist.

• Victim interactionRequired

  A legitimate user or administrator must take an action (such as triggering or being present during a profile field migration) for the exploit to execute.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker depends on specific environmental conditions such as an active migration state from a pre-3.3.8 phpBB install, making reliable exploitation conditional on that setup being present.

Blast Radius

• Reads stored database contents including user credentials, session tokens, private messages, and email addresses.
• Modifies persisted database rows including user profile fields, permissions, and forum configuration records.
• Degrades service availability for the forum by corrupting data structures or issuing resource-intensive queries.
• Exploitation is constrained to forums that were previously upgraded from a version older than 3.3.8 and have not yet reached 3.3.11 or newer, limiting the exposed population to that specific migration window.