SQL injection vulnerability in links.php in 4R Linklist 1.0 RC2 and earlier, a module for Woltlab Burning Board, allows remote attackers to execute arbitrary SQL commands via the cat parameter.
https://www.exploit-db.com/exploits/1810
https://exchange.xforce.ibmcloud.com/vulnerabilities/26592