CVE-2004-1785

SQL injection vulnerability in calendar.php for Invision Power Board 1.3 allows remote attackers to execute arbitrary SQL commands via the m parameter, which sets the $this->chosen_month variable.

Published: Jan 3, 2004
Updated: Apr 13, 2023
CVE: CVE-2004-1785
Severity: High
Exploit:

CVSS v2:

Severity: High
Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P

No CWE or OWASP classifications available.

Affected Software
References

Software	From	Fixed in
invision_power_services / invision_board	1.3	1.3.x
invision_power_services / invision_board	1.1.1	1.1.1.x
invision_power_services / invision_board	1.2	1.2.x
invision_power_services / invision_board	1.0	1.0.x
invision_power_services / invision_board	1.1.2	1.1.2.x
invision_power_services / invision_board	1.0.1	1.0.1.x

http://forums.invisionpower.com/index.php?act=ST&f=1&t=108786
http://secunia.com/advisories/10530
http://www.osvdb.org/3319
http://www.securityfocus.com/archive/1/348821
http://www.securityfocus.com/bid/9353
http://www.securitytracker.com/id?1008589

Vulnerability Database

CVE-2004-1785

Deep Security Visibility Without the Complexity