Invision Power Board admin.php script allows cross-site scripting
| invision-powerboard-admin-xss (22999) |  Medium Risk |
Description:
Invision Power Board is a free PHP-based Web forum software package distributed by Invision Power Services, Inc. Invision Power Board version 2.1 could allow cross-site scripting. A remote attacker could create a malicious URL link to the admin.php script containing embedded script in multiple parameters which, once the link is clicked, would be executed in the administrator's Web browser within the security context of the hosting site.
Note: If the attacker is able to gain Admin privileges, embedded script could also be added to the calendar title while a new calendar is being created.
Platforms Affected:
- Invision Power, Invision Power Board 2.1
Remedy:
Upgrade to the latest version of Invision Power Board (2.3 or later), available from the Invision Power Board Web site. See References.
Consequences:
Gain Access
References:
- Invision Power Board Web site, Invision Power Board at http://www.invisionboard.com.
- InvisionPBxss.pdf November 3, 2005, Invision Power Board Faille XSS at http://benji.redkod.org/audits/ipb.2.1.pdf. (This document is in French.)
- BID-15344: Invision Power Board Multiple Cross-Site Scripting Vulnerabilities
- BID-15345: Invision Power Board Multiple HTML Injection Vulnerabilities
- CVE-2005-3547: Cross-site scripting (XSS) vulnerability in Invision Power Board 2.1 allows remote attackers to inject arbitrary web script or HTML via the (1) adsess, (2) name, and (3) description parameters in admin.php, and the (4) ACP Notes, (5) Member Name, (6) Password, (7) Email Address, (8) Components, and multiple other input fields.
- OSVDB ID: 20516: Invision Power Board admin.php Multiple Variable XSS
- OSVDB ID: 20517: Invision Power Board Admin Interface APC Notes XSS
- OSVDB ID: 20518: Invision Power Board Admin Interface Member Profile Multiple Field XSS
- OSVDB ID: 20519: Invision Power Board admin.php Component Fields XSS
- OSVDB ID: 20520: Invision Power Board Admin Interface New Member Creation XSS
- OSVDB ID: 20521: Invision Power Board Admin Interface Group Icon Image Field XSS
- OSVDB ID: 20522: Invision Power Board Admin Interface Calendar Title XSS
- SA17443: Invision Power Board "adsess" Cross-Site Scripting Vulnerability
Reported:
Nov 07, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net