Secunia Advisory: SA10446 Print Advisory
Release Date: 2003-12-16

Critical: Moderately critical
Impact: Manipulation of data
Where: From remote

Software: Invision Power Board 1.x


Description:
JeiAr has reported a vulnerability in Invision Power Board, which potentially can be exploited by malicious people to manipulate data through HTTP.

The problem is that the "sort_key" parameter isn't properly validated. This can potentially be used to manipulate SQL queries.

Invision Power Board 1.3 and prior as well as the latest alpha version have been reported vulnerable.

Solution:
An update is available:

http://www.invisionboard.com/dow...act=dl&s=1&id=12&p=1

Provided and/or discovered by:
Reported by JeiAr.

Original Advisory:
http://forums.invisionpower.com/index.php?act=ST&f=1&t=106774

Source: Secunia

OS/2-eCS-ArcaOS General News

More in General  

OS/2-eCS-ArcaOS Software News

More in Software  

Latest Forum Posts

Site News

More in Site News