Unscored CVE-2006-1267 EUVD-2006-1271GHSA-hhc8-hr95-v86v

Invision Power Board 2.1.4 allows remote attackers to hijack sessions and possibly gain administrative privileges by obtaining the session …

Published Mar 19, 2006 · Updated Aug 7, 2024 · Assigned by mitre

Description

Invision Power Board 2.1.4 allows remote attackers to hijack sessions and possibly gain administrative privileges by obtaining the session ID from the s parameter, then replaying it in another request.

References

20060316 Re: Invision Power Board v2.1.4 - session hijacking mailing-list
20060314 Invision Power Board v2.1.4 - session hijacking mailing-list