{"cve": [{"lastseen": "2017-07-11T11:14:51", "bulletinFamily": "NVD", "description": "SQL injection vulnerability in index.php in Invision Power Board 1.3.1 Final and earlier allows remote attackers to execute arbitrary SQL commands via the st parameter.", "modified": "2017-07-10T21:32:31", "published": "2005-04-11T00:00:00", "id": "CVE-2005-1070", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-1070", "title": "CVE-2005-1070", "type": "cve", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "exploitdb": [{"lastseen": "2016-02-03T01:14:37", "bulletinFamily": "exploit", "description": "Invision Power Board 1.x ST Parameter SQL Injection Vulnerability. CVE-2005-1070. Webapps exploit for php platform", "modified": "2005-04-11T00:00:00", "published": "2005-04-11T00:00:00", "id": "EDB-ID:25380", "href": "https://www.exploit-db.com/exploits/25380/", "type": "exploitdb", "title": "Invision Power Board 1.x ST Parameter SQL Injection Vulnerability", "sourceData": "source: http://www.securityfocus.com/bid/13097/info\r\n\r\nInvision Power Board is reported prone to an SQL injection vulnerability. Due to improper filtering of user-supplied data, attackers may pass SQL statements to the underlying database through the 'st' parameter.\r\n\r\nInvision Power Board 1.3.1 and prior versions are affected by this issue. \r\n\r\nhttp://www.example.com/forums/index.php?act=Members&max_results=30&filter=1&sort_order=asc&sort_key=name&st=SQL_INJECTION ", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/25380/"}], "nessus": [{"lastseen": "2019-02-21T01:08:31", "bulletinFamily": "scanner", "description": "A version of Invision Power Board installed on the remote host suffers from a SQL injection vulnerability due to its failure to sanitize user input via the 'st' parameter to the 'index.php' script. An attacker can take advantage of this flaw to inject arbitrary SQL statements into Invision Power Board, possibly even modifying the database.", "modified": "2018-11-15T00:00:00", "id": "INVISION_POWER_BOARD_ST_SQL_INJECTION.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=18011", "published": "2005-04-11T00:00:00", "title": "Invision Power Board index.php Members Action st Parameter SQL Injection", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description) {\n script_id(18011);\n script_version(\"1.17\");\n\n script_cve_id(\"CVE-2005-1070\");\n script_bugtraq_id(13097);\n\n script_name(english:\"Invision Power Board index.php Members Action st Parameter SQL Injection\");\n \n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote web server contains a PHP script that is affected by a SQL\ninjection vulnerability.\" );\n script_set_attribute(attribute:\"description\", value:\n\"A version of Invision Power Board installed on the remote host suffers\nfrom a SQL injection vulnerability due to its failure to sanitize user\ninput via the 'st' parameter to the 'index.php' script. An attacker\ncan take advantage of this flaw to inject arbitrary SQL statements\ninto Invision Power Board, possibly even modifying the database.\" );\n script_set_attribute(attribute:\"see_also\", value:\"https://www.securityfocus.com/archive/1/395515\" );\n script_set_attribute(attribute:\"solution\", value:\n\"Unknown at this time.\" );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:W/RC:ND\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No exploit is required\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2005/04/11\");\n script_set_attribute(attribute:\"vuln_publication_date\", value: \"2005/04/09\");\n script_cvs_date(\"Date: 2018/11/15 20:50:17\");\nscript_set_attribute(attribute:\"plugin_type\", value:\"remote\");\nscript_set_attribute(attribute:\"cpe\",value:\"cpe:/a:invisionpower:invision_power_board\");\nscript_end_attributes();\n \n script_summary(english:\"Checks for st parameter SQL injection vulnerability in Invision Power Board\");\n script_category(ACT_ATTACK);\n script_family(english:\"CGI abuses\");\n script_copyright(english:\"This script is Copyright (C) 2005-2018 Tenable Network Security, Inc.\");\n script_dependencies(\"invision_power_board_detect.nasl\");\n script_exclude_keys(\"Settings/disable_cgi_scanning\");\n script_require_ports(\"Services/www\", 80);\n script_require_keys(\"www/invision_power_board\");\n exit(0);\n}\n\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"http.inc\");\n\n\nport = get_http_port(default:80);\nif (!can_host_php(port:port)) exit(0);\n\n\n# Test an install.\ninstall = get_kb_item(string(\"www/\", port, \"/invision_power_board\"));\nif (isnull(install)) exit(0);\nmatches = eregmatch(string:install, pattern:\"^(.+) under (/.*)$\");\nif (!isnull(matches)) {\n dir = matches[2];\n\n # Try to exploit it.\n w = http_send_recv3(method:\"GET\",\n item:string(\n dir, \"/index.php?\",\n \"act=Members&\", \n \"max_results=30&\",\n \"filter=1&\",\n \"sort_order=asc&\",\n \"sort_key=name&\",\n # nb: the 'st' parameter is used in a SELECT statement as the offset in\n # a LIMIT clause so appending a '--' will cause a syntax error\n # since it tells MySQL to ignore the rest of the statement.\n \"st=1--\"\n ),\n port:port\n );\n if (isnull(w)) exit(1, \"The web server did not answer\");\n res = w[2];\n\n if (\"<title>Invision Power Board Database Error\" >< res) \n {\n security_hole(port);\n set_kb_item(name: 'www/'+port+'/SQLInjection', value: TRUE);\n }\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}
