Invision Board < 2.0.5 Privilege Escalation / SQL Injection

High Nessus Network Monitor Plugin ID 2942

Synopsis

The remote web server contains a script that is vulnerable to a SQL injection attack.

Description

The remote host is running Invision Board, a CGI suite designed to set up a bulletin board system on the remote web server.
This version of Invision Board is vulnerable to a flaw in the way that it handles moving of users from one group to another group. It is reported that non-admin users can, when deleting a user account, optionally move the user into an administrative group.
This can allow users to elevate their rights to that of an administrator.

In addition to this, the remote version of this software is vulnerable to a SQL injection vulnerability that may allow an attacker to execute arbitrary SQL statements against the remote host.

Solution

Upgrade to version 2.0.5 or higher.

See Also

http://archives.neohapsis.com/archives/fulldisclosure/2005-05/0635.html

http://lists.grok.org.uk/pipermail/full-disclosure/2005-May/034355.html

http://forums.invisionpower.com/index.php?showtopic=169215

Plugin Details

Severity: High

ID: 2942

File Name: 2942.prm

Family: CGI

Published: 2005/05/29

Modified: 2016/01/15

Dependencies: 1442

Nessus ID: 18401

Risk Information

Risk Factor: High

CVSSv2

Base Score: 7.5

Temporal Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:H/RL:U/RC:ND

CVSSv3

Base Score: 7.3

Temporal Score: 7.3

Vector: CVSS3#AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS3#E:H/RL:U/RC:X

Reference Information

CVE: CVE-2005-1816, CVE-2005-2542, CVE-2006-0888

BID: 13797, 14492, 14289, 16616

OSVDB: 16911, 18709, 28142