Invision Power Board Multiple SQL Injection Vulnerabilities

Bugtraq ID:	42005
Class:	Input Validation Error
CVE:	CVE-2009-3974
Remote:	Yes
Local:	No
Published:	Nov 23 2009 12:00AM
Updated:	Nov 23 2009 12:00AM
Credit:	Unknown
Vulnerable:	Invision Power Services Invision Power Board 3.0.2 Invision Power Services Invision Power Board 3.0.1 Invision Power Services Invision Power Board 3.0
Not Vulnerable:

Invision Power Board Multiple SQL Injection Vulnerabilities

Invision Power Board is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Invision Power Board 3.0.0 through 3.0.2 are vulnerable. Other versions may also be affected.

Invision Power Board Multiple SQL Injection Vulnerabilities

Attackers can use a browser to exploit this issue.

Invision Power Board Multiple SQL Injection Vulnerabilities

Solution:
Updates are available; please see the references for more information.

Invision Power Board Multiple SQL Injection Vulnerabilities

References:

• Invision Power Board 3.0.2 Security Update (Invision Power Services )
  
• Invision Power Board Homepage (Invision Power Services )