high7.5Public exploit code
CVE-2006-6369
SQL injection vulnerability in lib/entry_reply_entry.php in Invision Community Blog Mod 1.2.4 allows remote attackers to execute arbitrary SQL commands via the…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Invision Community Blog Mod 1.2.4 - SQL Injection2006-12-01 · webapps · php · Verified
Impact
SQL injection vulnerability in lib/entry_reply_entry.php in Invision Community Blog Mod 1.2.4 allows remote attackers to execute arbitrary SQL commands via the eid parameter, when accessed through the "Preview message" functionality.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Invision Power Services | Invision Community Blog | Version 1.2.4 |
References
- NVD record
- CVE.org record
- http://forums.invisionpower.com/index.php?showtopic=230108
- http://www.securityfocus.com/archive/1/453126/100/100/threaded
- http://www.securityfocus.com/archive/1/453159/100/100/threaded
- http://www.vupen.com/english/advisories/2006/4820
- http://forums.invisionpower.com/index.php?showtopic=230108
- http://www.securityfocus.com/archive/1/453126/100/100/threaded
- http://www.securityfocus.com/archive/1/453159/100/100/threaded
- http://www.vupen.com/english/advisories/2006/4820