Description
SQL injection vulnerability in the do_mmod function in mod.php in Invision Community Blog (ICB) 1.1.2 final through 1.2 allows remote attackers with moderator privileges to execute arbitrary SQL commands via the selectedbids parameter.
References
- 17851 vdb-entry
- 20060508 Re: Invision Community Blog .. Bugs mailing-list
- http://forums.invisionpower.com/index.php?showtopic=214248&view=getnewpost
- 19973 third-party-advisory
- invision-mod-sql-injection(26290) vdb-entry
- 25252 vdb-entry
- 20060505 Invision Community Blog .. Bugs mailing-list