|
Family: CGI abuses --> Category: attack
Invision Power Board CLIENT_IP SQL Injection Vulnerability Vulnerability Scan
Vulnerability Scan Summary Checks version of IPB
Detailed Explanation for this Vulnerability Test
Synopsis :
The remote web server contains a PHP application that is susceptible
to a SQL injection attack.
Description :
According to its banner, the installation of Invision Power Board on
the remote host reportedly fails to sanitize input to the 'CLIENT_IP'
HTTP request header before using it in database queries. An
unauthenticated attacker may be able to leverage this issue to
disclose sensitive information, modify data, or launch attacks against
the underlying database.
Note that it's unclear whether successful exploitation depends on any
PHP settings, such as 'magic_quotes'.
See also :
http://www.milw0rm.com/exploits/2010
http://www.nessus.org/u?eea8694e
Solution :
Upgrade to Invision Power Board 2.1.7 or later.
Threat Level:
High / CVSS Base Score : 7
(AV:R/AC:L/Au:NR/C:P/A:P/I:P/B:N)
Click HERE for more information and discussions on this network vulnerability scan.
|