PT-2006-3179 · Invision · Invision Power Board

Mr.Snake · Publicado 2006-05-05 · Atualizado 2018-10-18 · CVE-2006-2204

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Invision Power Board version 2.1.5

Description The issue concerns a SQL injection vulnerability in the topic deletion functionality, specifically in the post delete function located in func mod.php. This vulnerability allows remote authenticated moderators to execute arbitrary SQL commands. The vulnerability is exploited via the selectedpids parameter, which can bypass an integer value check when the $id variable is an array.

Recommendations For Invision Power Board version 2.1.5, consider disabling the post delete function in func mod.php as a temporary workaround until a patch is available. Restrict access to the selectedpids parameter in the topic deletion functionality to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-2204

Produtos afetados

Invision Power Board

Referências · 10

• https://nvd.nist.gov/vuln/detail/CVE-2006-2204 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2204 · Nota
• http://forums.invisionpower.com/index.php?showtopic=214248&view=getnewpo · Correção
• http://vupen.com/english/advisories/2006/1605 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26190 · Nota
• http://securityreason.com/securityalert/551 · Nota
• http://securityfocus.com/archive/1/432948/30/0/threaded · Correção
• http://securityfocus.com/archive/1/432591/100/0/threaded · Nota
• http://secunia.com/advisories/19901 · Aviso do Fabricante
• http://securityfocus.com/bid/17837 · Correção