PT-2006-6980 · Invision Community · Invision Community Blog

Publicado 2006-12-07 · Atualizado 2018-10-17 · CVE-2006-6369

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Invision Community Blog Mod version 1.2.4

Description The issue allows remote attackers to execute arbitrary SQL commands via the eid parameter when the "Preview message" functionality is accessed. This is a result of a SQL injection vulnerability in the lib/entry reply entry.php file.

Recommendations For Invision Community Blog Mod version 1.2.4, avoid using the eid parameter in the "Preview message" functionality until a fix is available. As a temporary workaround, consider restricting access to the lib/entry reply entry.php file to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2006-6369

Produtos afetados

Invision Community Blog

Referências · 6

• 🔥 https://exploit-db.com/exploits/2877 · Exploit
• http://forums.invisionpower.com/index.php?showtopic=230108 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2006-6369 · Nota de Segurança
• http://vupen.com/english/advisories/2006/4820 · Nota
• http://securityfocus.com/archive/1/453126/100/100/threaded · Nota
• http://securityfocus.com/archive/1/453159/100/100/threaded · Nota