CVE-2021-39249

Invision Community (IPS Community Suite / IP-Board) prior to 4.6.5.1 is affected by a reflected XSS vulnerability. The issue arises because uploaded file names are predictable via brute-force against PHP mt_rand, enabling an attacker to craft payloads that may be reflected. Affected product: Invi...

CVE-2021-39250

Invision Community (IPS Community Suite/IP-Board) is affected by a stored XSS in versions prior to 4.6.5.1, which can lead to code execution. The vulnerability arises because an uploaded file can be placed inside an IFRAME within user-generated content. For exploitation, an attacker can rely on t...

IP. Board<=3.4.7 SQL injection vulnerability 0day）POC-vulnerability warning-the black bar safety net

Recently IP. Board = 3.4. 7 broke critical 0day vulnerability. IPB Forum is called Invision Power Board（abbreviated IPB or IP. Board, is the world's most famous Forum app by PHP+MySQL architecture. The vulnerability causes., interface/ipsconnect/ipsconnect. php page does not properly handle the i...

IP Board 3.x - CSRF Token hjiacking

No description provided by source. Title: IP Board 3.x CSRF - Token hjiacking Date: 03.09.14 Version: = 3.4.6 Vendor: invisionpower.com Author: Piotr S. Video-PoC: https://www.youtube.com/watch?v=G5P21TA4DjY 1 Introduction Latest and propabbly previous IPB verions suffers on vulnerability, which...

IP Board 3.x CSRF Token Theft

Title: IP Board 3.x CSRF - Token hjiacking Date: 03.09.14 Version: = 3.4.6 Vendor: invisionpower.com Author: Piotr S. Video-PoC: https://www.youtube.com/watch?v=G5P21TA4DjY 1 Introduction Latest and propabbly previous IPB verions suffers on vulnerability, which allows attacker to steal CSRF token...

IP Board 3.x CSRF - Token hjiacking Vulnerability

Usage Info Latest and propabbly previous IPB verions suffers on vulnerability, which allows attacker to steal CSRF token of specific user. Function, which allows users to share forum links, does not properly sanitize user input. Mentioned token is attached in request as GET parameter, so it's abl...

IP Board Login Auxiliary Module

This module attempts to validate user provided credentials against an IP Board web application. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/loginscanner/ipboard' require...

Invision Power Board <= 3.3.4 "unserialize()" PHP Code Execution

Exploit for php platform in category web applications ?php / ---------------------------------------------------------------- Invision Power Board = 3.3.4 "unserialize" PHP Code Execution ---------------------------------------------------------------- author..............: Egidio Romano aka EgiX...