if isMod and enableGroupMsgDelete SQL Injection Vulnerability

hi all.
file: bb_func_delmsg.php
code:
if(isset($enableGroupMsgDelete) and isset($_POST['deleteAll']) and is_array($_POST['deleteAll']) and sizeof($_POST['deleteAll'])>0) {
$deleteAll=$_POST['deleteAll'];

example:
<input type="checkbox" name="deleteAll[]" value="4444' [SQL] /*" />

Thanks for reporting, but... this time it seems this hack will not work for regular users at all ;-)

"isMod" variable is unset at the very beginning of index.php. So whatever you send externally, it will be set in the script itself anyway.

So you need to be logged in as moderator or admin to execute this "hack" which seems an absurd.

I have fixed this in the script anyway and released a small fix under the version 2.0.5b. Thank you.