PT-2003-2330 · Invision · Invision Power Board

Published 2003-12-31 · Updated 2017-07-29 · CVE-2003-1385

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Invision Power Board version 1.1.1

Description The issue allows remote attackers to execute arbitrary PHP code if register globals is enabled. This is achieved by modifying the root path parameter to reference a URL on a remote web server that contains the code.

Recommendations For Invision Power Board version 1.1.1, consider disabling the register globals setting to prevent exploitation. Additionally, restrict access to the ipchat.php file until a patch is available. Avoid using the root path parameter in the affected file until the issue is resolved.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2003-1385

Affected Products

Invision Power Board

References · 8

• 🔥 http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0099.html · Exploit
• 🔥 https://exploit-db.com/exploits/22295 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-1385 · Security Note
• http://osvdb.org/3357 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1385 · Note
• http://securityfocus.com/bid/6976 · Note
• http://secunia.com/advisories/8182 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11435 · Note