SQL injection vulnerability in the IPS Connect service (interface/ipsconnect/ipsconnect.php) in Invision Power Board (aka IPB or IP.Board) 3.3.x and 3.4.x through 3.4.7 before 20141114 allows remote attackers to execute arbitrary SQL commands via the id[] parameter.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9239
Reference (s):
- http://community.invisionpower.com/blogs/entry/9704-active-security-exploit/
- http://community.invisionpower.com/blogs/entry/9705-ipboard-33x-34x-security-update/
- FULLDISC:20141109 IP.Board <= 3.4.7 SQL Injection
- URL: http://seclists.org/fulldisclosure/2014/Nov/20