CVE-2007-4914

Severity: medium (CVSS 6.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-09-17 · updated 2026-06-16
Weakness: CWE-20

Description

Unspecified vulnerability in the subscriptions manager in Invision Power Board (IPB or IP.Board) 2.3.1 before 20070912 allows remote authenticated users to change the member ID and reduce the privilege level of arbitrary users via a crafted payment form, related to (1) class_gw_2checkout.php, (2) class_gw_authorizenet.php, (3) class_gw_nochex.php, (4) class_gw_paypal.php, and (5) class_gw_safshop.php in sources/classes/paymentgateways/.

Affected products

Invision Power Services Invision Power Board: through 2.3.1; 2.1.5_2006-03-08, 2.1.5_2006-04-25, 2.1.6, 2.2, 2.2.1, 2.2.2

References

http://forums.invisionpower.com/index.php?act=attach&type=post&id=11870
http://forums.invisionpower.com/index.php?showtopic=237075
http://osvdb.org/41319
http://osvdb.org/41320
http://osvdb.org/41321
http://osvdb.org/41322
http://osvdb.org/41323
http://secunia.com/advisories/26788
http://www.securityfocus.com/bid/25656
https://exchange.xforce.ibmcloud.com/vulnerabilities/36590
http://forums.invisionpower.com/index.php?act=attach&type=post&id=11870
http://forums.invisionpower.com/index.php?showtopic=237075

Get alerted when CVE-2007-4914 or the next vulnerability affects your stack