Description
SQL injection vulnerability in the IPS Connect service (interface/ipsconnect/ipsconnect.php) in Invision Power Board (aka IPB or IP.Board) 3.3.x and 3.4.x through 3.4.7 before 20141114 allows remote attackers to execute arbitrary SQL commands via the id[] parameter.
References (3)
Core 3
Core References
Patch x_refsource_confirm
http://community.invisionpower.com/blogs/entry/9705-ipboard-33x-34x-security-update/
Mailing List mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Nov/20
Exploit, Patch x_refsource_confirm
http://community.invisionpower.com/blogs/entry/9704-active-security-exploit/
Scores
EPSS
0.0136
EPSS Percentile
68.8%
Details
CWE
CWE-89
Status
published
Products (13)
invisioncommunity/invision_power_board
3.3.0 (7 CPE variants)
invisioncommunity/invision_power_board
3.3.1
invisioncommunity/invision_power_board
3.3.2
invisioncommunity/invision_power_board
3.3.3
invisioncommunity/invision_power_board
3.3.4
invisioncommunity/invision_power_board
3.4.0 (7 CPE variants)
invisioncommunity/invision_power_board
3.4.1
invisioncommunity/invision_power_board
3.4.2
invisioncommunity/invision_power_board
3.4.3
invisioncommunity/invision_power_board
3.4.4
... and 3 more
Published
Dec 03, 2014
Tracked Since
Feb 18, 2026