PT-2006-3179 · Invision · Invision Power Board

Mr.Snake · Published 2006-05-05 · Updated 2018-10-18 · CVE-2006-2204

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Invision Power Board version 2.1.5

Description The issue concerns a SQL injection vulnerability in the topic deletion functionality, specifically in the post delete function located in func mod.php. This vulnerability allows remote authenticated moderators to execute arbitrary SQL commands. The vulnerability is exploited via the selectedpids parameter, which can bypass an integer value check when the $id variable is an array.

Recommendations For Invision Power Board version 2.1.5, consider disabling the post delete function in func mod.php as a temporary workaround until a patch is available. Restrict access to the selectedpids parameter in the topic deletion functionality to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-2204

Affected Products

Invision Power Board

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2006-2204 · Security Note
• http://forums.invisionpower.com/index.php?showtopic=214248&view=getnewpo · Patch
• http://securityfocus.com/archive/1/432948/30/0/threaded · Patch
• http://secunia.com/advisories/19901 · Vendor Advisory
• http://securityfocus.com/bid/17837 · Patch
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2204 · Note
• http://vupen.com/english/advisories/2006/1605 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26190 · Note
• http://securityreason.com/securityalert/551 · Note
• http://securityfocus.com/archive/1/432591/100/0/threaded · Note