Multiple Vulnerabilities in KaiBB

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in KaiBB which could be exploited to perform script insertions and SQL injection attacks.

1) Script insertion vulnerability in KaiBB
Input passed to the "[url]" BBCode tag is not properly sanitized. A remote attacker can insert arbitrary HTML and script code, which will be executed in user`s browser in context of the vulnerable website when user views the malicious data.
Exploitation example:
[img][url=http://1 onerror=javascript:alert(document.cookie);"']Text Here[/url][/img]

2) SQL injection vulnerabilities in KaiBB
2.1 The vulnerability exists due to input sanitation errors in the "user" parameter in index.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data in the database.
Exploitation example:
http://[host]/index.php?user=999%27%20union%20select%201,@@version,3,4,5,6,7 ,8,9,10,11,12,13,14%20-- %201
2.2 The vulnerability exists due to input sanitation errors in the "term" parameter in index.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data in the database.
Exploitation example:
http://[host]/index.php?s=search&term=123%27/**/union/**/select/**/1,@@versi on,1,1,1/**/%23