CVE-2004-1531

SQL injection vulnerability in post.php in Invision Power Board (IPB) 2.0.0 through 2.0.2 allows remote attackers to execute arbitrary SQL commands via the qpid parameter.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://forums.invisionpower.com/index.php?showtopic=154916	Patch
http://marc.info/?l=bugtraq&m=110079592702417&w=2
http://marc.info/?l=bugtraq&m=111454805209191&w=2
http://marc.info/?l=bugtraq&m=111462421824202&w=2
http://secunia.com/advisories/13245	Patch
http://www.securityfocus.com/bid/11703	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/18164

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:invision_power_services:invision_board:2.0:::::::*
	cpe:2.3:a:invision_power_services:invision_board:2.0.1:::::::*
	cpe:2.3:a:invision_power_services:invision_board:2.0.2:::::::*

History

No history.

Information

Published : 2004-12-31 05:00

Updated : 2017-07-11 01:31

NVD link : CVE-2004-1531

Mitre link : CVE-2004-1531

CVE.ORG link : CVE-2004-1531

JSON object : View

Products Affected

invision_power_services

invision_board

CWE

NVD-CWE-Other

{"id": "CVE-2004-1531", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2004-12-31T05:00:00.000", "references": [{"url": "http://forums.invisionpower.com/index.php?showtopic=154916", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=110079592702417&w=2", "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=111454805209191&w=2", "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=111462421824202&w=2", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/13245", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/11703", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18164", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in post.php in Invision Power Board (IPB) 2.0.0 through 2.0.2 allows remote attackers to execute arbitrary SQL commands via the qpid parameter."}], "lastModified": "2017-07-11T01:31:06.873", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:invision_power_services:invision_board:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FABB6806-5DC0-4146-89FC-05D079F0CFEB"}, {"criteria": "cpe:2.3:a:invision_power_services:invision_board:2.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C77C15A2-9A9D-4C3F-8A62-18C54941B79C"}, {"criteria": "cpe:2.3:a:invision_power_services:invision_board:2.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A2C79F9F-FE3C-4CC6-88A9-6EFB27724CA9"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}