Description
Invision Power Board (IPB) 1.0 through 2.0.4 allows non-root admins to add themselves or other users to the root admin group via the "Move users in this group to" screen.
References
- 15545 third-party-advisory
- 13797 vdb-entry
- 20050528 Invision Power Board 1.x and 2.x Privilege Escalation Vulnerability mailing-list