Unscored severity · published May 9, 2006
CVE-2006-2251
SQL injection vulnerability in the do_mmod function in mod.php in Invision Community Blog (ICB) 1.1.2 final through 1.2 allows remote attackers with moderator privileges to…
–
CVSS
1.4%
EPSS
No
On KEV
Description
SQL injection vulnerability in the do_mmod function in mod.php in Invision Community Blog (ICB) 1.1.2 final through 1.2 allows remote attackers with moderator privileges to execute arbitrary SQL commands via the selectedbids parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
Invision Community Blog · Invision Power Services
1.0; 1.1; 1.1.2_final; 1.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-2251
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-2251
Patch
http://archives.neohapsis.com/archives/bugtraq/2006-05/0142.html
Patch
http://forums.invisionpower.com/index.php?showtopic=214248&view=getnewpost
Patch
http://secunia.com/advisories/19973
www.osvdb.org
http://www.osvdb.org/25252
Patch
http://www.securityfocus.com/archive/1/433076
Exploit
http://www.securityfocus.com/bid/17851
More from Invision Community Blog
–
CVE-2006-6369
SQL injection vulnerability in lib/entry_reply_entry.php in Invision Community Blog Mod 1.2.4 allows remote attackers to execute arbitrary SQL commands via the eid parameter, when…
–
CVE-2005-1945
Cross-site scripting (XSS) vulnerability in the convert_highlite_words function in Invision Blog before 1.1.2 Final allows remote attackers to inject arbitrary web script or HTML…
–
CVE-2005-1946
Multiple SQL injection vulnerabilities in Invision Blog before 1.1.2 Final allow remote attackers to execute arbitrary SQL commands via the (1) eid parameter to an editentry,…
–
CVE-2005-0217
SQL injection vulnerability in index.php in Invision Community Blog allows remote attackers to execute arbitrary SQL commands via the eid parameter