CVE-2009-3974: SQL Injection

Published Nov 18, 2009

Updated

Multiple SQL injection vulnerabilities in Invision Power Board (IPB or IP.Board) 3.0.0, 3.0.1, and 3.0.2 allow remote attackers to execute arbitrary SQL commands via the (1) searchterm parameter to admin/applications/core/modulespublic/search/search.php and (2) aid parameter to admin/applications/core/modulespublic/global/lostpass.php. NOTE: on 20090818, the vendor patched 3.0.2 without changing the version number.

Affected Software

3 affected components

Invisioncommunity Invision Power Board=3.0.0

Invisioncommunity Invision Power Board=3.0.1

Invisioncommunity Invision Power Board=3.0.2

Remediation

Patch Available

http://www.vupen.com/english/advisories/2009/2413

Event History

Nov 18, 2009

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-3974?

CVE-2009-3974 is considered a high-severity vulnerability due to the potential for remote SQL injection attacks.

How do I fix CVE-2009-3974?

To fix CVE-2009-3974, upgrade Invision Power Board to version 3.0.3 or later, where this issue has been addressed.

What versions of Invision Power Board are affected by CVE-2009-3974?

CVE-2009-3974 affects Invision Power Board versions 3.0.0, 3.0.1, and 3.0.2.

What types of attacks can be executed due to CVE-2009-3974?

Due to CVE-2009-3974, attackers can execute arbitrary SQL commands on the database, potentially leading to data breaches.

Is CVE-2009-3974 still a risk today?

While CVE-2009-3974 is an older vulnerability, any systems running the affected versions remain at risk if not patched.