Invision Power Board "qpid" Remote SQL Injection Vulnerability

[AlphaWolf]

 FrSIRT Advisory : FrSIRT/ADV-2005-0402
CVE Reference : GENERIC-MAP-NOMATCH
Rated as : Moderate
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2005-04-26

 * Technical Description *

A new vulnerability was identified in Invision Power Board, which may be exploited by remote attackers to execute arbitrary SQL commands. This flaw is due to an input validation error in the "index.php" file when handling a specially crafted "qpid" parameter, which may be exploited by remote users to conduct SQL injection attacks.

 * Affected Products *

Invision Power Board (IPB) 2.0.1 and prior

 * Solution *

The FrSIRT is not aware of any official supplied patch for this issue.

 * References *

http://www.frsirt.com/english/advisories/2005/0402