Lucene search

[email protected]CVE-2006-3544

HistoryJul 13, 2006 - 12:05 a.m.

CVE-2006-3544

2006-07-1300:05:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve

2006

3544

sql injection

invision power board

ipb

stats

mail

reg

index.php

9.5 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.005 Low

EPSS

Percentile

76.5%

JSON

Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 1.3 Final allow remote attackers to execute arbitrary SQL commands via the CODE parameter in a (1) Stats, (2) Mail, and (3) Reg action in index.php. NOTE: the developer has disputed this issue, stating that "At no point does the CODE parameter touch the database. The CODE parameter is used in a SWITCH statement to determine which function to run.

CPENameOperatorVersion
invision_power_services:invision_boardinvision power services invision boardeq1.3.1_final
invision_power_services:invision_boardinvision power services invision boardeq1.3_final

CPE	Name	Operator	Version
invision_power_services:invision_board	invision power services invision board	eq	1.3.1_final
invision_power_services:invision_board	invision power services invision board	eq	1.3_final

References

securityreason.com/securityalert/1225

www.osvdb.org/30084

www.securityfocus.com/archive/1/438961/100/0/threaded

www.securityfocus.com/archive/1/439629/100/0/threaded

www.securityfocus.com/bid/18782

exchange.xforce.ibmcloud.com/vulnerabilities/27555

9.5 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.005 Low

EPSS

Percentile

76.5%

JSON

Related for CVE-2006-3544

cvelist1