PT-2006-3445 · Invision · Invision Power Board

Steven M. Christey · Published 2006-05-20 · Updated 2017-07-20 · CVE-2006-2498

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Invision Power Board (IPB) versions prior to 2.1.6

Description The issue allows remote attackers to execute arbitrary PHP script. This can be achieved through attack vectors involving the post icon variable in the classes/post/class post.php file and the df value in the action public/moderate.php file.

Recommendations For Invision Power Board (IPB) versions prior to 2.1.6, update to version 2.1.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the classes/post/class post.php and action public/moderate.php files to minimize the risk of exploitation. Avoid using the post icon variable and the df value in the affected files until the issue is resolved.

Fix

Related Identifiers

CVE-2006-2498

Affected Products

Invision Power Board

References · 11

• http://forums.invisionpower.com/index.php?showtopic=215527 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-2498 · Security Note
• http://secunia.com/advisories/20158 · Vendor Advisory
• http://forums.invisionpower.com/index.php?act=Attach&type=post&id=10026 · Patch
• http://vupen.com/english/advisories/2006/1859 · Note
• http://osvdb.org/25667 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2498 · Note
• http://osvdb.org/25668 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26541 · Note
• http://securityfocus.com/bid/18040 · Note
• http://attrition.org/pipermail/vim/2006-May/000776.html · Note