Release Date: 2003-12-16
Critical: Moderately critical
Impact: Manipulation of data
Where: From remote
Software: Invision Power Board 1.x
Description:
JeiAr has reported a vulnerability in Invision Power Board, which potentially can be exploited by malicious people to manipulate data through HTTP.
The problem is that the "sort_key" parameter isn't properly validated. This can potentially be used to manipulate SQL queries.
Invision Power Board 1.3 and prior as well as the latest alpha version have been reported vulnerable.
Solution:
An update is available:
http://www.invisionboard.com/dow...act=dl&s=1&id=12&p=1
Provided and/or discovered by:
Reported by JeiAr.
Original Advisory:
http://forums.invisionpower.com/index.php?act=ST&f=1&t=106774
Source: Secunia