PT-2006-5938 · Invision · Invision Power Board

Publicado 2006-10-09 · Atualizado 2018-10-17 · CVE-2006-5203

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Invision Power Board (IPB) versions 2.1.7 and earlier

Description The issue allows remote restricted administrators to inject arbitrary web script or HTML, or execute arbitrary SQL commands. This can be achieved by creating a forum description that contains a crafted image with PHP code. The PHP code is executed when the user visits the "Manage Forums" link in the Admin control panel.

Recommendations For Invision Power Board (IPB) versions 2.1.7 and earlier, consider restricting access to the Admin control panel's "Manage Forums" link until a fix is available. As a temporary workaround, avoid using crafted images in forum descriptions to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-5203

Produtos afetados

Invision Power Board

Referências · 4

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5203 · Nota
• http://securityfocus.com/archive/1/447710/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29352 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-5203 · Nota de Segurança