Invision Power Board < 3.0.5 Multiple Vulnerabilities

medium Nessus Plugin ID 43163

Synopsis

The remote web server hosts a PHP application that is affected by multiple vulnerabilities.

Description

The remote web server hosts a version of Invision Power Board earlier than 3.0.5. Such versions are potentially affected by multiple vulnerabilities :

- A local-file include vulnerability affects the 'section' parameter sent to the 'forum/index.php' script.

- A SQL injection vulnerability affects the 'starter' and 'state' parameters of the 'admin/applications/forum/modules_public/moderate/moderate.php' script.

- A cross-site scripting vulnerability is caused by incorrect handling of '.txt' file attachments.

Solution

Upgrade to Invision Power Board 3.0.5 or later.

See Also

https://seclists.org/bugtraq/2009/Dec/139

https://seclists.org/fulldisclosure/2009/Dec/105

http://www.nessus.org/u?1407869f

Plugin Details

Severity: Medium

ID: 43163

File Name: invision_power_board_305.nasl

Version: 1.13

Type: remote

Family: CGI abuses

Published: 12/15/2009

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Vulnerability Information

CPE: cpe:/a:invisionpower:invision_power_board

Required KB Items: www/invision_power_board

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/8/2009

Vulnerability Publication Date: 12/4/2009

Reference Information

BID: 37208, 37263

SECUNIA: 37598, 37680