cbcvebase.
CVE-2009-3974
published 2009-11-18

CVE-2009-3974: Multiple SQL injection vulnerabilities in Invision Power Board (IPB or IP.Board) 3.0.0, 3.0.1, and 3.0.2 allow remote attackers to execute arbitrary SQL…

PriorityP337high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
1.00%
58.5th percentile
Multiple SQL injection vulnerabilities in Invision Power Board (IPB or IP.Board) 3.0.0, 3.0.1, and 3.0.2 allow remote attackers to execute arbitrary SQL commands via the (1) search_term parameter to admin/applications/core/modules_public/search/search.php and (2) aid parameter to admin/applications/core/modules_public/global/lostpass.php. NOTE: on 20090818, the vendor patched 3.0.2 without changing the version number.

Affected

3 ranges
VendorProductVersion rangeFixed in
invisioncommunityinvision_power_board——
invisioncommunityinvision_power_board——
invisioncommunityinvision_power_board——
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.