Vulnerabilities > CVE-2006-2097 - SQL Injection vulnerability in Invision Power Board Func_msg.PHP

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
invision-power-services
exploit available
NVD
Published: 2006-04-29
Updated: 2018-10-18

Summary

SQL injection vulnerability in func_msg.php in Invision Power Board (IPB) 2.1.4 allows remote attackers to execute arbitrary SQL commands via the from_contact field in a private message (PM).

Vulnerable Configurations

Part Description Count
Application
Invision_Power_Services
26

Exploit-Db

descriptionInvision Power Board <= 2.1.5 (from_contact) SQL Injection Exploit. CVE-2006-2097. Webapps exploit for php platform
idEDB-ID:1733
last seen2016-01-31
modified2006-05-01
published2006-05-01
reporterYkstortion Security
sourcehttps://www.exploit-db.com/download/1733/
titleInvision Power Board <= 2.1.5 from_contact SQL Injection Exploit

References