high7.5
CVE-2014-9239
SQL injection vulnerability in the IPS Connect service (interface/ipsconnect/ipsconnect.php) in Invision Power Board (aka IPB or IP.Board) 3.3.x and 3.4.x thro…
Impact
SQL injection vulnerability in the IPS Connect service (interface/ipsconnect/ipsconnect.php) in Invision Power Board (aka IPB or IP.Board) 3.3.x and 3.4.x through 3.4.7 before 20141114 allows remote attackers to execute arbitrary SQL commands via the id[] parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Invisioncommunity | Invision Power Board | Versions 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.4.0 |
| Invisionpower | Invision Power Board | Version 3.4.7 |
Weakness classification
References
- NVD record
- CVE.org record
- http://community.invisionpower.com/blogs/entry/9704-active-security-exploit/
- http://community.invisionpower.com/blogs/entry/9705-ipboard-33x-34x-security-update/
- http://seclists.org/fulldisclosure/2014/Nov/20
- http://community.invisionpower.com/blogs/entry/9704-active-security-exploit/
- http://community.invisionpower.com/blogs/entry/9705-ipboard-33x-34x-security-update/
- http://seclists.org/fulldisclosure/2014/Nov/20