First published: Sat Feb 24 2007(Updated: )
Cross-site scripting (XSS) vulnerability in forum/admin.php for Invision Power Board (IPB) 2.1.6 and earlier allows remote attackers to inject arbitrary web script or HTML as the administrator via the phpinfo parameter.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Invision Power Board | =1.0 | |
Invision Power Board | =1.0.1 | |
Invision Power Board | =1.0.3 | |
Invision Power Board | =1.1.1 | |
Invision Power Board | =1.1.2 | |
Invision Power Board | =1.2 | |
Invision Power Board | =1.3 | |
Invision Power Board | =1.3.1_final | |
Invision Power Board | =1.3_final | |
Invision Power Board | =2.0 | |
Invision Power Board | =2.0.0 | |
Invision Power Board | =2.0.1 | |
Invision Power Board | =2.0.2 | |
Invision Power Board | =2.0.3 | |
Invision Power Board | =2.0.4 | |
Invision Power Board | =2.0.x | |
Invision Power Board | =2.0_alpha3 | |
Invision Power Board | =2.0_pdr3 | |
Invision Power Board | =2.0_pf1 | |
Invision Power Board | =2.0_pf2 | |
Invision Power Board | =2.1 | |
Invision Power Board | =2.1.0 | |
Invision Power Board | =2.1.1 | |
Invision Power Board | =2.1.2 | |
Invision Power Board | =2.1.3 | |
Invision Power Board | =2.1.4 | |
Invision Power Board | =2.1.5 | |
Invision Power Board | =2.1.5_2006-03-08 | |
Invision Power Board | =2.1.5_2006-04-25 | |
Invision Power Board | =2.1.6 | |
Invision Power Board | =2.1_alpha2 | |
Invision Power Board | =2.1_beta2 | |
Invision Power Board | =2.1_beta3 | |
Invision Power Board | =2.1_beta4 | |
Invision Power Board | =2.1_beta5 | |
Invision Power Board | =2.1_rc1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2006-7064 is classified as a medium severity vulnerability due to its ability to exploit administrator privileges via XSS.
To fix CVE-2006-7064, it is recommended to upgrade to a version of Invision Power Board that is not vulnerable, specifically versions after 2.1.6.
CVE-2006-7064 affects Invision Power Board versions up to and including 2.1.6.
CVE-2006-7064 is associated with cross-site scripting (XSS) attacks that allow remote attackers to inject arbitrary web scripts or HTML.
Yes, CVE-2006-7064 can significantly compromise a website's security by allowing attackers to exploit administrative functionalities.