CVE

Id
19647  
CVE No.
CVE-2006-3543  
Status
Candidate  
Description
** DISPUTED ** Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 1.x and 2.x allow remote attackers to execute arbitrary SQL commands via the (1) idcat and (2) code parameters in a ketqua action in index.php; the id parameter in a (3) Attach and (4) ref action in index.php; the CODE parameter in a (5) Profile, (6) Login, and (7) Help action in index.php; and the (8) member_id parameter in coins_list.php. NOTE: the developer has disputed this issue, stating that the "CODE attribute is never present in an SQL query" and the ""ketqua" [action] and file "coin_list.php" are not standard IPB 2.x features". It is unknown whether these vectors are associated with an independent module or modification of IPB.  
Phase
Assigned (20060712)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
177693 19647 CVE-2006-3543 BUGTRAQ:20060704 Invision Power Board "v1.X & 2.X" SQL Injection  View
177694 19647 CVE-2006-3543 URL:http://www.securityfocus.com/archive/1/archive/1/439145/100/0/threaded  View
177695 19647 CVE-2006-3543 BUGTRAQ:20060710 Re: Invision Power Board "v1.X & 2.X" SQL Injection  View
177696 19647 CVE-2006-3543 URL:http://www.securityfocus.com/archive/1/archive/1/439602/100/0/threaded  View
177697 19647 CVE-2006-3543 BID:18836  View
177698 19647 CVE-2006-3543 URL:http://www.securityfocus.com/bid/18836  View
177699 19647 CVE-2006-3543 OSVDB:30084  View
177700 19647 CVE-2006-3543 URL:http://www.osvdb.org/30084  View
177701 19647 CVE-2006-3543 SREASON:1231  View

Related JVN