CVE-2014-9239: SQL Injection
Published Dec 3, 2014
·Updated
SQL injection vulnerability in the IPS Connect service (interface/ipsconnect/ipsconnect.php) in Invision Power Board (aka IPB or IP.Board) 3.3.x and 3.4.x through 3.4.7 before 20141114 allows remote attackers to execute arbitrary SQL commands via the id[] parameter.
Affected Software
25 affected components
Invisioncommunity Invision Power Board=3.3.0
Invisioncommunity Invision Power Board=3.3.0-alpha1
Invisioncommunity Invision Power Board=3.3.0-alpha2
Invisioncommunity Invision Power Board=3.3.0-beta1
Invisioncommunity Invision Power Board=3.3.0-beta2
Invisioncommunity Invision Power Board=3.3.0-beta3
Invisioncommunity Invision Power Board=3.3.0-beta4
Invisioncommunity Invision Power Board=3.3.1
Invisioncommunity Invision Power Board=3.3.2
Invisioncommunity Invision Power Board=3.3.3
Invisioncommunity Invision Power Board=3.3.4
Invisioncommunity Invision Power Board=3.4.0
Invisioncommunity Invision Power Board=3.4.0-alpha1
Invisioncommunity Invision Power Board=3.4.0-beta1
Invisioncommunity Invision Power Board=3.4.0-beta2
Invisioncommunity Invision Power Board=3.4.0-beta3
Invisioncommunity Invision Power Board=3.4.0-beta4
Invisioncommunity Invision Power Board=3.4.0-beta5
Invisioncommunity Invision Power Board=3.4.1
Invisioncommunity Invision Power Board=3.4.2
Invisioncommunity Invision Power Board=3.4.3
Invisioncommunity Invision Power Board=3.4.4
Invisioncommunity Invision Power Board=3.4.5
Invisioncommunity Invision Power Board=3.4.6
Invisionpower Invision Power Board=3.4.7
Remediation
Event History
Dec 3, 2014
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-9239?
CVE-2014-9239 has a moderate severity rating, allowing remote attackers to execute arbitrary SQL commands.
2
How do I fix CVE-2014-9239?
To fix CVE-2014-9239, upgrade Invision Power Board to version 3.4.7 or later.
3
Which versions of Invision Power Board are affected by CVE-2014-9239?
CVE-2014-9239 affects Invision Power Board versions 3.3.x and 3.4.x up to 3.4.6.
4
Can CVE-2014-9239 be exploited remotely?
Yes, CVE-2014-9239 can be exploited remotely through crafted requests to the IPS Connect service.
5
What is the impact of CVE-2014-9239?
The impact of CVE-2014-9239 is that attackers can manipulate the database, potentially leading to data theft or corruption.