PT-2006-3041 · Invision · Invision Power Board

Iceshaman + 1 · Published 2006-04-26 · Updated 2018-10-18 · CVE-2006-2060

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Invision Power Board (IPB) versions 2.0.x through 2.1.x

Description The issue allows remote authenticated administrators to include and execute arbitrary local PHP files via a .. (dot dot) in the name parameter, preceded by enough backspace (%08) characters to erase the initial static portion of a filename. This is a directory traversal vulnerability.

Recommendations For Invision Power Board (IPB) versions 2.0.x through 2.1.x, update to a version released after 20060425 to resolve the issue.

Fix

Related Identifiers

CVE-2006-2060

Affected Products

Invision Power Board

References · 11

• http://forums.invisionpower.com/index.php?showtopic=213374 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-2060 · Security Note
• http://securityreason.com/securityalert/796 · Note
• http://securityfocus.com/archive/1/439607/100/0/threaded · Note
• http://osvdb.org/25008 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2060 · Note
• http://secunia.com/advisories/19830 · Note
• http://vupen.com/english/advisories/2006/1534 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26072 · Note
• http://securityfocus.com/archive/1/431990/100/0/threaded · Note
• http://securityfocus.com/archive/1/432226/100/0/threaded · Note