PT-2006-6980 · Invision Community · Invision Community Blog

Published 2006-12-07 · Updated 2018-10-17 · CVE-2006-6369

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Invision Community Blog Mod version 1.2.4

Description The issue allows remote attackers to execute arbitrary SQL commands via the eid parameter when the "Preview message" functionality is accessed. This is a result of a SQL injection vulnerability in the lib/entry reply entry.php file.

Recommendations For Invision Community Blog Mod version 1.2.4, avoid using the eid parameter in the "Preview message" functionality until a fix is available. As a temporary workaround, consider restricting access to the lib/entry reply entry.php file to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2006-6369

Affected Products

Invision Community Blog

References · 6

• 🔥 https://exploit-db.com/exploits/2877 · Exploit
• http://forums.invisionpower.com/index.php?showtopic=230108 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-6369 · Security Note
• http://vupen.com/english/advisories/2006/4820 · Note
• http://securityfocus.com/archive/1/453126/100/100/threaded · Note
• http://securityfocus.com/archive/1/453159/100/100/threaded · Note