SQL injection vulnerability in groupcp.php for phpBB 2.0.6 and earlier allows group moderators to perform unauthorized activities via the sql_in parameter.
https://exchange.xforce.ibmcloud.com/vulnerabilities/14096
https://euvd.enisa.europa.eu/vulnerability/EUVD-2003-1205
http://www.securityfocus.com/bid/9314