CVE-2006-2204

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2006-2204
SQL injection vulnerability in the topic deletion functionality (post_delete function in func_mod.php) for Invision Power Board 2.1.5 allows remote authenticated moderators to execute arbitrary SQL commands via the selectedpids parameter, which bypasses an integer value check when the $id variable is an array.

5.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:N

Exploitability : 8.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://forums.invisionpower.com/index.php?showtopic=214248&view=getnewpo Patch
http://secunia.com/advisories/19901 Patch Vendor Advisory
http://securityreason.com/securityalert/551
http://www.securityfocus.com/archive/1/432591/100/0/threaded
http://www.securityfocus.com/archive/1/432948/30/0/threaded Patch
http://www.securityfocus.com/bid/17837 Patch
http://www.vupen.com/english/advisories/2006/1605
https://exchange.xforce.ibmcloud.com/vulnerabilities/26190
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:invision_power_services:invision_power_board:2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:invision_power_services:invision_power_board:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:invision_power_services:invision_power_board:2.0.2:*:*:*:*:*:*:*
cpe:2.3:a:invision_power_services:invision_power_board:2.0.3:*:*:*:*:*:*:*
cpe:2.3:a:invision_power_services:invision_power_board:2.0.4:*:*:*:*:*:*:*
cpe:2.3:a:invision_power_services:invision_power_board:2.0.x:*:*:*:*:*:*:*
cpe:2.3:a:invision_power_services:invision_power_board:2.1:*:*:*:*:*:*:*
cpe:2.3:a:invision_power_services:invision_power_board:2.1.0:*:*:*:*:*:*:*
cpe:2.3:a:invision_power_services:invision_power_board:2.1.1:*:*:*:*:*:*:*
cpe:2.3:a:invision_power_services:invision_power_board:2.1.2:*:*:*:*:*:*:*
cpe:2.3:a:invision_power_services:invision_power_board:2.1.3:*:*:*:*:*:*:*
cpe:2.3:a:invision_power_services:invision_power_board:2.1.4:*:*:*:*:*:*:*
cpe:2.3:a:invision_power_services:invision_power_board:2.1.5:*:*:*:*:*:*:*
cpe:2.3:a:invision_power_services:invision_power_board:2.1_alpha2:*:*:*:*:*:*:*
cpe:2.3:a:invision_power_services:invision_power_board:2.1_beta2:*:*:*:*:*:*:*
cpe:2.3:a:invision_power_services:invision_power_board:2.1_beta3:*:*:*:*:*:*:*
cpe:2.3:a:invision_power_services:invision_power_board:2.1_beta4:*:*:*:*:*:*:*
cpe:2.3:a:invision_power_services:invision_power_board:2.1_beta5:*:*:*:*:*:*:*
cpe:2.3:a:invision_power_services:invision_power_board:2.1_rc1:*:*:*:*:*:*:*
History

No history.

Information

Published : 2006-05-05 12:46

Updated : 2018-10-18 16:38

NVD link : CVE-2006-2204

Mitre link : CVE-2006-2204

CVE.ORG link : CVE-2006-2204

JSON object : View

Products Affected

invision_power_services

  • invision_power_board
CWE
NVD-CWE-Other