TITLE:
Invision Power Board Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA19830

VERIFY ADVISORY:
http://secunia.com/advisories/19830/

CRITICAL:
Highly critical

IMPACT:
Security Bypass, Cross Site Scripting, Manipulation of data, System
access

WHERE:
>From remote

SOFTWARE:
Invision Power Board 2.x
http://secunia.com/product/3705/

DESCRIPTION:
Some vulnerabilities have been reported in Invision Power Board,
which can be exploited by malicious people to conduct script
insertion and SQL injection attacks, and compromise a vulnerable
system.

1) Input passed to the "lastdate" parameter in "search.php" isn't
properly sanitised before being used in a "preg_replace()" call. This
can be exploited to inject and execute arbitrary PHP code via the "e"
pattern modifier.

The vulnerability has been reported in versions 2.0 through 2.1.5.

2) Input passed to the "ck" parameter in "index.php" isn't properly
sanitised before being used in a SQL query. This can be exploited to
manipulate SQL queries by injecting arbitrary SQL code (limited to 32
characters).

It is also possible by administrators to include arbitrary PHP
scripts via the "name" parameter passed in "admin.php".

The vulnerability has been reported in versions 2.0 through 2.1.5.

3) The problem is that it is possible to upload a malicious JPEG
image with a GIF header containing HTML and script code. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site when the malicious
image is viewed with the Microsoft Internet Explorer browser.

The vulnerability has been reported in versions 2.1 through 2.1.5.

SOLUTION:
Apply patches.
http://forums.invisionpower.com/index.php?showtopic=213374

PROVIDED AND/OR DISCOVERED BY:
1) Originally discovered by "securicore" security group and reported
to public mailing lists by IceShaman and Wells.
2) IceShaman and Wells.
3) Reported by the vendor.

ORIGINAL ADVISORY:
http://forums.invisionpower.com/index.php?showtopic=213374

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------