Vulnerability Details CVE-2014-9239
SQL injection vulnerability in the IPS Connect service (interface/ipsconnect/ipsconnect.php) in Invision Power Board (aka IPB or IP.Board) 3.3.x and 3.4.x through 3.4.7 before 20141114 allows remote attackers to execute arbitrary SQL commands via the id[] parameter.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 57.3%
CVSS Severity
CVSS v2 Score 7.5
References
- http://community.invisionpower.com/blogs/entry/9704-active-security-exploit/
- http://community.invisionpower.com/blogs/entry/9705-ipboard-33x-34x-security-update/
- http://seclists.org/fulldisclosure/2014/Nov/20
- http://community.invisionpower.com/blogs/entry/9704-active-security-exploit/
- http://community.invisionpower.com/blogs/entry/9705-ipboard-33x-34x-security-update/
- http://seclists.org/fulldisclosure/2014/Nov/20
Products affected by CVE-2014-9239
-
cpe:2.3:a:invisioncommunity:invision_power_board:3.3.0
-
cpe:2.3:a:invisioncommunity:invision_power_board:3.3.1
-
cpe:2.3:a:invisioncommunity:invision_power_board:3.3.2
-
cpe:2.3:a:invisioncommunity:invision_power_board:3.3.3
-
cpe:2.3:a:invisioncommunity:invision_power_board:3.3.4
-
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.0
-
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.1
-
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.2
-
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.3
-
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.4
-
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.5
-
cpe:2.3:a:invisioncommunity:invision_power_board:3.4.6
-
cpe:2.3:a:invisionpower:invision_power_board:3.4.7