LayerBB 1.1.4 contains an SQL injection flaw that lets unauthenticated attackers build malicious queries through the search_query POST parameter. By inserting CASE WHEN expressions, the attacker can drill into database tables to read privileged information. This weakness is a classic input validation failure classified as CWE‑89 and can lead to full data exposure or further attack progression if the attacker gains write access.

The vulnerability affects LayerBB Community Edition, specifically version 1.1.4; earlier minor releases in the 1.0.x and 1.1.x series are also listed in the CPE range but the exploit is confirmed against 1.1.4.

With a CVSS score of 8.8 the flaw is considered high severity. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known widespread exploitation yet. Because authentication is not required and the attack vector is simple HTTP POST to /search.php, an attacker with network access to the application can exploit it out of band to read database contents, potentially leading to full compromise of the system.