medium4.3Public exploit code

CVE-2006-1326

Multiple cross-site scripting (XSS) vulnerabilities in Invision Power Board 2.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) res…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Invision Power Services Invision Board 2.0.4 - Members Action Multiple Cross-Site Scripting Vulnerabilities2006-03-17 · webapps · php · Verified
Invision Power Board (IP.Board) 2.0.4 - Help Action 'HID' Cross-Site Scripting2006-03-17 · webapps · php · Verified
Invision Power Board (IP.Board) 2.0.4 - Mail Action 'MID' Cross-Site Scripting2006-03-17 · webapps · php · Verified
Invision Power Board (IP.Board) 2.0.4 - Print Action 't' Cross-Site Scripting2006-03-17 · webapps · php · Verified
Invision Power Board (IP.Board) 2.0.4 - Calendar Action Multiple Cross-Site Scripting Vulnerabilities2006-03-17 · webapps · php · Verified
Invision Power Board (IP.Board) 2.0.4 - 'index.php?st' Cross-Site Scripting2006-03-17 · webapps · php · Verified
Invision Power Board (IP.Board) 2.0.4 - Search Action Multiple Cross-Site Scripting Vulnerabilities2006-03-17 · webapps · php · Verified

Impact

Multiple cross-site scripting (XSS) vulnerabilities in Invision Power Board 2.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) result_type, (2) search_in, (3) nav, (4) forums, and (5) s parameters in the Search action to index.php; (6) st parameter to index.php with showtopics set to 1; (7) m, (8) y, and (9) d parameters in a calendar action; (10) t parameter in a Print action; (11) MID parameter in a Mail action; (12) HID parameter in a Help action; (13) active parameter in a search action; (14) sort_order, (15) max_results, or (16) sort_key parameter in a Members action.

Affected products

Vendor	Product	Affected versions
Invision Power Services	Invision Power Board	Version 2.0.4

Public exploit code

Impact

Affected products

References