PT-2006-4419 · Invision · Invision Power Board

Breeeeh · Published 2006-07-13 · Updated 2024-08-07 · CVE-2006-3544

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Invision Power Board version 1.3 Final

Description The issue concerns SQL injection vulnerabilities that could allow remote attackers to execute arbitrary SQL commands. This is allegedly possible via the CODE parameter in certain actions in index.php, including Stats, Mail, and Reg. However, the developer has disputed this, stating that the CODE parameter does not interact with the database and is used in a SWITCH statement to determine which function to run.

Recommendations For Invision Power Board version 1.3 Final, consider restricting access to the CODE parameter in the affected API endpoints, such as "/index.php" with actions Stats, Mail, and Reg, until the dispute is resolved or more information is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-3544

Affected Products

Invision Power Board

References · 9

• 🔥 http://securityfocus.com/bid/18782 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-3544 · Security Note
• http://securityfocus.com/archive/1/439629/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3544 · Note
• http://securityfocus.com/archive/1/438961/100/0/threaded · Note
• https://t.me/cvenotify/89793 · Telegram Post
• http://securityreason.com/securityalert/1225 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27555 · Note
• http://osvdb.org/30084 · Note