1. CVE-Search
  2. CVE-2006-2204
ID CVE-2006-2204
Summary SQL injection vulnerability in the topic deletion functionality (post_delete function in func_mod.php) for Invision Power Board 2.1.5 allows remote authenticated moderators to execute arbitrary SQL commands via the selectedpids parameter, which bypasses an integer value check when the $id variable is an array.
References
Vulnerable Configurations
  • cpe:2.3:a:invision_power_services:invision_power_board:2.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:invision_power_services:invision_power_board:2.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:invision_power_services:invision_power_board:2.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:invision_power_services:invision_power_board:2.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:invision_power_services:invision_power_board:2.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:invision_power_services:invision_power_board:2.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:invision_power_services:invision_power_board:2.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:invision_power_services:invision_power_board:2.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:invision_power_services:invision_power_board:2.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:invision_power_services:invision_power_board:2.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:invision_power_services:invision_power_board:2.0.x:*:*:*:*:*:*:*
    cpe:2.3:a:invision_power_services:invision_power_board:2.0.x:*:*:*:*:*:*:*
  • cpe:2.3:a:invision_power_services:invision_power_board:2.1:*:*:*:*:*:*:*
    cpe:2.3:a:invision_power_services:invision_power_board:2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:invision_power_services:invision_power_board:2.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:invision_power_services:invision_power_board:2.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:invision_power_services:invision_power_board:2.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:invision_power_services:invision_power_board:2.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:invision_power_services:invision_power_board:2.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:invision_power_services:invision_power_board:2.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:invision_power_services:invision_power_board:2.1.3:*:*:*:*:*:*:*
    cpe:2.3:a:invision_power_services:invision_power_board:2.1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:invision_power_services:invision_power_board:2.1.4:*:*:*:*:*:*:*
    cpe:2.3:a:invision_power_services:invision_power_board:2.1.4:*:*:*:*:*:*:*
  • cpe:2.3:a:invision_power_services:invision_power_board:2.1.5:*:*:*:*:*:*:*
    cpe:2.3:a:invision_power_services:invision_power_board:2.1.5:*:*:*:*:*:*:*
  • cpe:2.3:a:invision_power_services:invision_power_board:2.1_alpha2:*:*:*:*:*:*:*
    cpe:2.3:a:invision_power_services:invision_power_board:2.1_alpha2:*:*:*:*:*:*:*
  • cpe:2.3:a:invision_power_services:invision_power_board:2.1_beta2:*:*:*:*:*:*:*
    cpe:2.3:a:invision_power_services:invision_power_board:2.1_beta2:*:*:*:*:*:*:*
  • cpe:2.3:a:invision_power_services:invision_power_board:2.1_beta3:*:*:*:*:*:*:*
    cpe:2.3:a:invision_power_services:invision_power_board:2.1_beta3:*:*:*:*:*:*:*
  • cpe:2.3:a:invision_power_services:invision_power_board:2.1_beta4:*:*:*:*:*:*:*
    cpe:2.3:a:invision_power_services:invision_power_board:2.1_beta4:*:*:*:*:*:*:*
  • cpe:2.3:a:invision_power_services:invision_power_board:2.1_beta5:*:*:*:*:*:*:*
    cpe:2.3:a:invision_power_services:invision_power_board:2.1_beta5:*:*:*:*:*:*:*
  • cpe:2.3:a:invision_power_services:invision_power_board:2.1_rc1:*:*:*:*:*:*:*
    cpe:2.3:a:invision_power_services:invision_power_board:2.1_rc1:*:*:*:*:*:*:*
CVSS
Base: 5.5 (as of 18-10-2018 - 16:38)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL NONE
cvss-vector via4 AV:N/AC:L/Au:S/C:P/I:P/A:N
refmap via4
bid 17837
bugtraq
  • 20060428 Invision Power Board v2.1.5 Remote SQL Injection
  • 20060504 Re: Invision Power Board v2.1.5 Remote SQL Injection
confirm http://forums.invisionpower.com/index.php?showtopic=214248&view=getnewpo
secunia 19901
sreason 551
vupen ADV-2006-1605
xf invision-func_mod-sql-injection(26190)
Last major update 18-10-2018 - 16:38
Published 05-05-2006 - 12:46
Last modified 18-10-2018 - 16:38
Back to Top