CVE-2006-2204: SQL Injection
SQL injection vulnerability in the topic deletion functionality (postdelete function in funcmod.php) for Invision Power Board 2.1.5 allows remote authenticated moderators to execute arbitrary SQL commands via the selectedpids parameter, which bypasses an integer value check when the $id variable is an array.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-2204?
CVE-2006-2204 has been classified as a critical vulnerability due to the potential for remote code execution through SQL injection.
How do I fix CVE-2006-2204?
To fix CVE-2006-2204, upgrade your Invision Power Board to version 2.1.6 or later, which addresses this SQL injection vulnerability.
What are the affected versions for CVE-2006-2204?
CVE-2006-2204 affects Invision Power Board versions 2.0.0 to 2.1.5.
Who can exploit CVE-2006-2204?
CVE-2006-2204 can be exploited by remote authenticated moderators.
What is the attack vector for CVE-2006-2204?
The attack vector for CVE-2006-2204 involves manipulating the selectedpids parameter in the post_delete function in func_mod.php.