Invision Power Board Calendar.PHP SQL Injection Vulnerability

Bugtraq ID:	9353
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 04 2004 12:00AM
Updated:	Jan 04 2004 12:00AM
Credit:	Discovery credited to frog-m@n.
Vulnerable:	Invision Power Services Invision Board 1.3 Invision Power Services Invision Board 1.2 Invision Power Services Invision Board 1.1.2 Invision Power Services Invision Board 1.1.1 Invision Power Services Invision Board 1.0.1 Invision Power Services Invision Board 1.0
Not Vulnerable:

Invision Power Board Calendar.PHP SQL Injection Vulnerability

Invision Power Board is prone to SQL injection attacks. This issue will permit a remote attacker to manipulate database queries, possibly resulting in bulletin board compromise, information disclosure or other consequences.

Invision Power Board Calendar.PHP SQL Injection Vulnerability

This issue may be exploited with a web browser.

Invision Power Board Calendar.PHP SQL Injection Vulnerability

Solution:
The vendor has made a fix available for this issue. See references for additional details.

Invision Power Board Calendar.PHP SQL Injection Vulnerability

References:

• Security Update for 1.3 (Invision Power Services)
  
• [SCSA-025] Invision Power Board SQL Injection Vulnerability ()