CVE-2007-4914

Unspecified vulnerability in the subscriptions manager in Invision Power Board (IPB or IP.Board) 2.3.1 before 20070912 allows remote authenticated users to change the member ID and reduce the privilege level of arbitrary users via a crafted payment form, related to (1) class_gw_2checkout.php, (2) class_gw_authorizenet.php, (3) class_gw_nochex.php, (4) class_gw_paypal.php, and (5) class_gw_safshop.php in sources/classes/paymentgateways/.

Link	Resource
http://forums.invisionpower.com/index.php?act=attach&type=post&id=11870	Patch
http://forums.invisionpower.com/index.php?showtopic=237075	Patch
http://www.securityfocus.com/bid/25656
http://secunia.com/advisories/26788	Vendor Advisory
http://osvdb.org/41323
http://osvdb.org/41319
http://osvdb.org/41321
http://osvdb.org/41322
http://osvdb.org/41320
https://exchange.xforce.ibmcloud.com/vulnerabilities/36590

Configuration 1

cpe:2.3:a:invision_power_services:invision_power_board:2.2:*:*:*:*:*:*:* cpe:2.3:a:invision_power_services:invision_power_board:2.2.2:*:*:*:*:*:*:* cpe:2.3:a:invision_power_services:invision_power_board:2.1.6:*:*:*:*:*:*:* cpe:2.3:a:invision_power_services:invision_power_board:2.1.5_2006-03-08:*:*:*:*:*:*:* cpe:2.3:a:invision_power_services:invision_power_board:2.1.5_2006-04-25:*:*:*:*:*:*:* cpe:2.3:a:invision_power_services:invision_power_board:2.2.1:*:*:*:*:*:*:* cpe:2.3:a:invision_power_services:invision_power_board:*:*:*:*:*:*:*:*

---

Published : 2007-09-17 05:17

Updated : 2017-07-29 01:33

---

NVD link : CVE-2007-4914

Mitre link : CVE-2007-4914

No products.

CWE-20