Invision Power Board is prone to a local file-include vulnerability and multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit the local file-include vulnerability using directory- traversal strings to view and execute arbitrary local files within the context of the webserver process. Information harvested may aid in further attacks. The attacker can exploit the SQL-injection vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Invision Power Board 3.0.4 and 2.3.6 are vulnerable other versions may also be affected.

• http://www.invisionpower.com/community/board/index.html
• http://www.securityfocus.com/archive/1/508207
• http://www.securityfocus.com/bid/37208

---

Updated on 2015-03-25