CVE-2014-9239

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-12-03 · updated 2026-06-17
Weakness: CWE-89

Description

SQL injection vulnerability in the IPS Connect service (interface/ipsconnect/ipsconnect.php) in Invision Power Board (aka IPB or IP.Board) 3.3.x and 3.4.x through 3.4.7 before 20141114 allows remote attackers to execute arbitrary SQL commands via the id[] parameter.

Affected products

Kaspersky Lab Invision Power Board: 3.3.0, 3.3.0-alpha1, 3.3.0-alpha2, 3.3.0-beta1, 3.3.0-beta2, 3.3.0-beta3 (+18)
Invisionpower Invision Power Board: 3.4.7

References

http://community.invisionpower.com/blogs/entry/9704-active-security-exploit/
http://community.invisionpower.com/blogs/entry/9705-ipboard-33x-34x-security-update/
http://seclists.org/fulldisclosure/2014/Nov/20
http://community.invisionpower.com/blogs/entry/9704-active-security-exploit/
http://community.invisionpower.com/blogs/entry/9705-ipboard-33x-34x-security-update/
http://seclists.org/fulldisclosure/2014/Nov/20

Get alerted when CVE-2014-9239 or the next vulnerability affects your stack