Multiple SQL injection vulnerabilities in DeluxeBB 1.06 allow remote attackers to execute arbitrary SQL commands via the (1) hideemail (2) languagex (3) xthetimeoffset and (4) xthetimeformat parameters during account registration.