CVE-2006-1288

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-03-19 · updated 2026-06-16

Description

Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 2.0.4 and 2.1.4 before 20060105 allow remote attackers to execute arbitrary SQL commands via cookies, related to (1) arrays of id/stamp pairs and (2) the keys in arrays of key/value pairs in ipsclass.php; (3) the topics variable in usercp.php; and the topicsread cookie in (4) topics.php, (5) search.php, and (6) forums.php.

Affected products

Invision Power Services Invision Power Board: 2.0.4, 2.1.4

References

http://forums.invisionpower.com/index.php?act=Attach&type=post&id=9642
http://forums.invisionpower.com/index.php?showtopic=204627
http://secunia.com/advisories/19141
http://www.vupen.com/english/advisories/2006/0861
https://exchange.xforce.ibmcloud.com/vulnerabilities/25100
http://forums.invisionpower.com/index.php?act=Attach&type=post&id=9642
http://forums.invisionpower.com/index.php?showtopic=204627
http://secunia.com/advisories/19141
http://www.vupen.com/english/advisories/2006/0861
https://exchange.xforce.ibmcloud.com/vulnerabilities/25100

Get alerted when CVE-2006-1288 or the next vulnerability affects your stack