Bugtraq mailing list archives
Re: Multiple Vulnerabilities in Invision Power Board v1.3.1 Final.
From: Mike Healan <mike () spywareinfo com>
Date: Wed, 09 Jun 2004 18:56:17 -0400
Where is the vendor response to this? From what I can see at their support site, they've never heard of these two problems.
Let me guess, you never bothered to contact them and instead elected to publicize full instructions to exploit software in use at over 100,000 web sites?
JvdR wrote:
Description: Multiple Vulnerabilities in Invision Power Board v1.3.1 Final. Compromise: SQL Injection, Cross site Scripting. Vulnerable Systems: Invision Power Board v1.3.1 Final. Details: An Input Validation Error exists in ssi.php. $sql_fields is vulnerable to An Input Validation Error. How to exploit this bug? http://TARGET/ssi.php?a=out&type=xml&f=0)[SQL-INJECTION] The second bug is : Multiple Cross site Scripting bugs. The vulnerable fields of Invision Power Board are "f","c","username","showtopic","showuser". How to exploit this bug? http://TARGET/index.php?act=Reg&CODE=2&coppa_user=0&UserName='><script>alert (document.cookie)</script> Solution: No solution provided. Greetings, Jan van de Rijt aka The Warlock. http://members.home.nl/thewarlock/
-- Regards, Mike Healan Editor www.spywareinfo.com
Current thread:
- Multiple Vulnerabilities in Invision Power Board v1.3.1 Final. JvdR (Jun 09)
- Re: Multiple Vulnerabilities in Invision Power Board v1.3.1 Final. Mike Healan (Jun 10)
- <Possible follow-ups>
- Re: Multiple Vulnerabilities in Invision Power Board v1.3.1 Final. Hillel Himovich (Jun 11)