CVE-2006-2060: Medium severity invision power services invision power board vulnerability

Published Apr 26, 2006

Updated

Directory traversal vulnerability in actionadmin/paysubscriptions.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote authenticated administrators to include and execute arbitrary local PHP files via a .. (dot dot) in the name parameter, preceded by enough backspace (%08) characters to erase the initial static portion of a filename.

Affected Software

2 affected components

Invision Power Services Invision Power Board=2.0.x

Invision Power Services Invision Power Board=2.1.x

Remediation

Patch Available

http://forums.invisionpower.com/index.php?showtopic=213374

Event History

Apr 26, 2006

CVE Published

08:06 PM

Apr 27, 2006

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-2060?

CVE-2006-2060 is classified as a high severity vulnerability due to its potential for remote code execution.

How do I fix CVE-2006-2060?

To fix CVE-2006-2060, update to the latest version of Invision Power Board released after April 25, 2006.

Who is affected by CVE-2006-2060?

CVE-2006-2060 affects authenticated administrators using Invision Power Board versions 2.0.x and 2.1.x prior to April 25, 2006.

What type of vulnerability is CVE-2006-2060?

CVE-2006-2060 is a directory traversal vulnerability that allows unauthorized file execution.

Can CVE-2006-2060 lead to data compromise?

Yes, CVE-2006-2060 can lead to significant data compromise due to the ability to execute arbitrary PHP files.