Invision Power Board (IP.Board) xmlout.php data manipulation
| ipb-xmlout-data-manipulation (34841) |  Low Risk |
Description:
Invision Power Board (IP.Board) could allow a remote attacker to manipulate data, caused by a vulnerability in the xmlout.php script. A remote attacker could exploit this vulnerability to modify another user's AIM or Yahoo! Identity and other sensitive information.
Platforms Affected:
- Invision Power, Invision Power Board 2.2.0 - 2.2.2
Remedy:
Refer to IP.Board Forums, 11-June 07 08:42 PM for patch, upgrade, or suggested workaround information. See References.
Consequences:
Data Manipulation
References:
- IP.Board Forums, 11-June 07 08:42 PM , IP.Board 2.2.x Security Update at http://forums.invisionpower.com/index.php?showtopic=235316.
- BID-24442: Invision Power Board Profile Updating Access Validation Vulnerability
- CVE-2007-3219: Unspecified vulnerability in sources/action_public/xmlout.php in Invision Power Board (IPB or IP.Board) 2.2.0 through 2.2.2 allows remote attackers to modify another user's profile data, such as an AIM screen name or Yahoo! identity.
- OSVDB ID: 35436: Invision Power Board sources/action_public/xmlout.php Arbitrary Profile Manipulation
- SA25637: Invision Power Board Profile Updating Security Issue
- VUPEN/ADV-2007-2160: Invision Power Board xmlout.php Arbitrary Profile Manipulation Security Weakness
Reported:
Jun 11, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net