PT-2006-5938 · Invision · Invision Power Board

Published 2006-10-09 · Updated 2018-10-17 · CVE-2006-5203

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Invision Power Board (IPB) versions 2.1.7 and earlier

Description The issue allows remote restricted administrators to inject arbitrary web script or HTML, or execute arbitrary SQL commands. This can be achieved by creating a forum description that contains a crafted image with PHP code. The PHP code is executed when the user visits the "Manage Forums" link in the Admin control panel.

Recommendations For Invision Power Board (IPB) versions 2.1.7 and earlier, consider restricting access to the Admin control panel's "Manage Forums" link until a fix is available. As a temporary workaround, avoid using crafted images in forum descriptions to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-5203

Affected Products

Invision Power Board

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2006-5203 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5203 · Note
• http://securityfocus.com/archive/1/447710/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29352 · Note