A critical SQL injection bug exists in Phorum version 3.4.7 that allows a remote attacker to view sensitive data. The problem code lies in userlogin.php.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/33112/waraxe-2004-SA019.txt
Source: https://packetstormsecurity.com/files/33112/waraxe-2004-SA019.txt.html