Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Invision Board < 2.0.5 Privilege Escalation / SQL Injection



The remote web server contains a script that is vulnerable to a SQL injection attack.


The remote host is running Invision Board, a CGI suite designed to set up a bulletin board system on the remote web server. This version of Invision Board is vulnerable to a flaw in the way that it handles moving of users from one group to another group. It is reported that non-admin users can, when deleting a user account, optionally move the user into an administrative group. This can allow users to elevate their rights to that of an administrator.

In addition to this, the remote version of this software is vulnerable to a SQL injection vulnerability that may allow an attacker to execute arbitrary SQL statements against the remote host.


Upgrade to version 2.0.5 or higher.