cbcvebase.
CVE-2006-3543
published 2006-07-13

CVE-2006-3543: Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 1.x and 2.x allow remote attackers to execute arbitrary SQL commands via the (1) idcat and…

PriorityP337high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
1.07%
60.6th percentile
Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 1.x and 2.x allow remote attackers to execute arbitrary SQL commands via the (1) idcat and (2) code parameters in a ketqua action in index.php; the id parameter in a (3) Attach and (4) ref action in index.php; the CODE parameter in a (5) Profile, (6) Login, and (7) Help action in index.php; and the (8) member_id parameter in coins_list.php. NOTE: the developer has disputed this issue, stating that the "CODE attribute is never present in an SQL query" and the "'ketqua' [action] and file 'coin_list.php' are not standard IPB 2.x features". It is unknown whether these vectors are associated with an independent module or modification of IPB

Affected

23 ranges
VendorProductVersion rangeFixed in
invision_power_servicesinvision_power_board——
invision_power_servicesinvision_power_board——
invision_power_servicesinvision_power_board——
invision_power_servicesinvision_power_board——
invision_power_servicesinvision_power_board——
invision_power_servicesinvision_power_board——
invision_power_servicesinvision_power_board——
invision_power_servicesinvision_power_board——
invision_power_servicesinvision_power_board——
invision_power_servicesinvision_power_board——
invision_power_servicesinvision_power_board——
invision_power_servicesinvision_power_board——
invision_power_servicesinvision_power_board——
invision_power_servicesinvision_power_board——
invision_power_servicesinvision_power_board——
invision_power_servicesinvision_power_board——
invision_power_servicesinvision_power_board——
invision_power_servicesinvision_power_board——
invision_power_servicesinvision_power_board——
invision_power_servicesinvision_power_board——
invision_power_servicesinvision_power_board——
invision_power_servicesinvision_power_board——
invision_power_servicesinvision_power_board——
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.