Summary
Invision Power Board is prone to a local file-include vulnerability and multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker can exploit the local file-include vulnerability using directory- traversal strings to view and execute arbitrary local files within the context of the webserver process. Information harvested may aid in further attacks.
The attacker can exploit the SQL-injection vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Invision Power Board 3.0.4 and 2.3.6 are vulnerable other versions
may also be affected.
References
Severity
Classification
-
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities
- A-A-S Application Access Server Multiple Vulnerabilities
- 4Images <= 1.7.1 Directory Traversal Vulnerability
- Advantech Studio 'NTWebServer.exe' Directory Traversal Vulnerability
- Apache Struts2 'URL' & 'Anchor' tags Arbitrary Java Method Execution Vulnerabilities
- AWCM CMS Multiple Remote File Include Vulnerabilities