Detections
Analytics
Invision Community Blog Multiple Vulnerabilities (SQLi, XSS)
medium Nessus Plugin ID 18446
Language:
Synopsis
The remote web server contains a PHP application that is vulnerable to multiple attacks.Description
The remote host is running Invision Community Blog, a plugin for Invision Power Board that lets users have their own blogs.The version installed on the remote host fails to properly sanitize user-supplied data making it prone to multiple SQL injection and cross-site scripting vulnerabilities. These flaws may allow an attacker to gain access to sensitive information such as passwords and cookie data.
Solution
Upgrade to Invision Community Blog 1.1.2 Final or greater.See Also
Plugin Details
Severity: Medium
ID: 18446
File Name: invision_community_blog_multiple_input_vulns.nasl
Version: 1.21
Type: remote
Family: CGI abuses
Published: 6/10/2005
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.6
CVSS v2
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 6.5
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:invision_power_services:invision_community_blog
Required KB Items: www/invision_power_board
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: No exploit is required
Vulnerability Publication Date: 6/7/2005
Reference Information
CVE: CVE-2005-1945, CVE-2005-1946
BID: 13910