The vulnerability allows an attacker to inject malicious SQL commands into the phpBB profile field migration process, resulting in arbitrary SQL execution. This flaw arises from inadequate sanitization of user‑supplied profile data during migration. Successful exploitation could compromise database integrity, disclose sensitive data, or modify forum content.

Forums running phpBB, specifically versions updated from pre‑3.3.8 releases and not yet patched to 3.3.11 or newer, are affected. The issue is tied to the migration feature that transfers legacy profile fields into the new schema.

A CVSS score of 7.1 indicates high severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is a remote web request that triggers the migration routine, allowing an unauthenticated or low‑privileged user to supply crafted profile data and execute arbitrary SQL statements.