Unscored severity · published Nov 18, 2009
CVE-2009-3974
Multiple SQL injection vulnerabilities in Invision Power Board (IPB or IP.Board) 3.0.0, 3.0.1, and 3.0.2 allow remote attackers to execute arbitrary SQL commands via the (1)…
–
CVSS
1%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in Invision Power Board (IPB or IP.Board) 3.0.0, 3.0.1, and 3.0.2 allow remote attackers to execute arbitrary SQL commands via the (1) search_term parameter to admin/applications/core/modules_public/search/search.php and (2) aid parameter to admin/applications/core/modules_public/global/lostpass.php. NOTE: on 20090818, the vendor patched 3.0.2 without changing the version number.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IP
Invision Power Board · Invisioncommunity
3.0.0; 3.0.1; 3.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3974
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3974
Vendor Advisory
http://forums.invisionpower.com/topic/291103-invision-power-board-3-0-2-security-update/
Patch
http://www.vupen.com/english/advisories/2009/2413
More from Invision Power Board
9.8
CVE-2013-3725
Invision Power Board (IPB) through 3.x allows admin account takeover leading to code execution
9.8
CVE-2012-2226
Invision Power Board before 3.3.1 fails to sanitize user-supplied input which could allow remote attackers to obtain sensitive information or execute arbitrary code by uploading a…
9.8
CVE-2017-8898
Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power Board moderator to an…
8.8
CVE-2014-4928
SQL injection vulnerability in Invision Power Board (aka IPB or IP.Board) before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the cId parameter
8.1
CVE-2017-8899
Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature found in User CP