“Search.php” in Punbb versions 1.2.8 and earlier does not properly validate user-supplied input. A remote user can create specially crafted parameter values that will execute SQL commands on the underlying database. POC included.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/40838/Punbb-1.2.8.txt
Source: https://packetstormsecurity.com/files/40838/Punbb-1.2.8.txt.html