CVE-2014-9239

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-9239
SQL injection vulnerability in the IPS Connect service (interface/ipsconnect/ipsconnect.php) in Invision Power Board (aka IPB or IP.Board) 3.3.x and 3.4.x through 3.4.7 before 20141114 allows remote attackers to execute arbitrary SQL commands via the id[] parameter.

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://community.invisionpower.com/blogs/entry/9704-active-security-exploit/ Exploit Patch
http://community.invisionpower.com/blogs/entry/9705-ipboard-33x-34x-security-update/ Patch
http://seclists.org/fulldisclosure/2014/Nov/20
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:invisioncommunity:invision_power_board:3.3.0:*:*:*:*:*:*:*
cpe:2.3:a:invisioncommunity:invision_power_board:3.3.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:invisioncommunity:invision_power_board:3.3.0:alpha2:*:*:*:*:*:*
cpe:2.3:a:invisioncommunity:invision_power_board:3.3.0:beta1:*:*:*:*:*:*
cpe:2.3:a:invisioncommunity:invision_power_board:3.3.0:beta2:*:*:*:*:*:*
cpe:2.3:a:invisioncommunity:invision_power_board:3.3.0:beta3:*:*:*:*:*:*
cpe:2.3:a:invisioncommunity:invision_power_board:3.3.0:beta4:*:*:*:*:*:*
cpe:2.3:a:invisioncommunity:invision_power_board:3.3.1:*:*:*:*:*:*:*
cpe:2.3:a:invisioncommunity:invision_power_board:3.3.2:*:*:*:*:*:*:*
cpe:2.3:a:invisioncommunity:invision_power_board:3.3.3:*:*:*:*:*:*:*
cpe:2.3:a:invisioncommunity:invision_power_board:3.3.4:*:*:*:*:*:*:*
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.0:*:*:*:*:*:*:*
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.0:beta1:*:*:*:*:*:*
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.0:beta2:*:*:*:*:*:*
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.0:beta3:*:*:*:*:*:*
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.0:beta4:*:*:*:*:*:*
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.0:beta5:*:*:*:*:*:*
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.1:*:*:*:*:*:*:*
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.2:*:*:*:*:*:*:*
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.3:*:*:*:*:*:*:*
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.4:*:*:*:*:*:*:*
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.5:*:*:*:*:*:*:*
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.6:*:*:*:*:*:*:*
cpe:2.3:a:invisionpower:invision_power_board:3.4.7:*:*:*:*:*:*:*
History

No history.

Information

Published : 2014-12-03 21:59

Updated : 2023-12-10 11:31

NVD link : CVE-2014-9239

Mitre link : CVE-2014-9239

CVE.ORG link : CVE-2014-9239

JSON object : View

Products Affected

invisionpower

  • invision_power_board

invisioncommunity

  • invision_power_board
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')