---

[Message Precedent sur la mailing][Message Suivant sur la mailing][Precedent dans le fil][Prochain dans le fil][Index par Date][Index par fil] [SA26788] Invision Power Board Multiple Vulnerabilities

---

---

BETA test the new Secunia Personal Software Inspector! The Secunia PSI detects installed software on your computer and categorises it as either Insecure, End-of-Life, or Up-To-Date.

Effectively enabling you to focus your attention on software installations where more secure versions are available from the vendors.

Download the free PSI BETA from the Secunia website: link://[click]

TITLE: Invision Power Board Multiple Vulnerabilities

SECUNIA ADVISORY ID: SA26788

VERIFY ADVISORY: link://[click]

CRITICAL: Less critical

IMPACT: Security Bypass, Cross Site Scripting

WHERE: From remote SOFTWARE: Invision Power Board 2.x link://[click]

DESCRIPTION: Some vulnerabilities have been reported in Invision Power Board, which can be exploited by malicious users to conduct script insertion attacks or bypass certain access restrictions.

1) Input passed to unspecified fields in the user profile is not properly sanitised in ips_kernel/class_ajax.php before being used.

This can be exploited to insert arbitrary HTML and script code, which is executed in an administrative user's browser session in context of an affected site when the malicious user's profile is being viewed.

Successful exploitation requires that Invision Power Board is configured to use character sets different from "iso-8859-1" and "utf-8".

2) An error exists in the subscription manager when processing payments. This can be exploited to modify a member's ID via a specially crafted payment form.

Successful exploitation allows e.g. demoting administrators and moderators to the subscriber's group, but requires that the subscription packages are enabled.

The vulnerabilities are reported in versions 2.3.1. Prior versions may also be affected.

SOLUTION: Download version 2.3.1, which has been updated to fix the vulnerabilities.

link://[click] Apply the vendor patch.

link://[click] Follow the manual patch instructions.

link://[click] PROVIDED AND/OR DISCOVERED BY: 1) The vendor credits link://[click].

2) The vendor credits link://[click].



ORIGINAL ADVISORY: link://[click]

About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.

Subscribe: link://[click]

Definitions: (Criticality, Where etc.) link://[click]

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link.

Secunia NEVER sends attached files with advisories.

Secunia does not advise people to install third party patches, only use those supplied by the vendor.

---

• Precedent par Date: [SA26760] Red Hat update for kernel
• Suivant par Date: [SA26807] Storm Player AVI File Processing Buffer Overflow
• Precedent par fil : [SA26760] Red Hat update for kernel
• Suivant par fil : [SA26807] Storm Player AVI File Processing Buffer Overflow
• Index(s):
  • Date
  • Fil

---

Archives de la liste de diffusion Secunia
Archives de la liste de diffusion BugTraq
Archives de la liste de diffusion DailyDave
Archives de la liste de diffusion FunSec
Archives de la liste de diffusion Full Disclosure
Archives de la liste de diffusion Focus-IDS (FD)
Archives de la liste de diffusion Webappsec (FD)
Archives de la liste de diffusion Security-basics (FD)
Archives de la liste de diffusion Vulndiscuss
Archives de la liste de diffusion Vulnwatch