Vulnerability-Lookup

CVE-2006-2059 (GCVE-0-2006-2059)

Vulnerability from cvelistv5 – Published: 2006-04-26 20:00 – Updated: 2024-08-07 17:35

Summary

action_public/search.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary PHP code via a search with a crafted value of the lastdate parameter, which alters the behavior of a regular expression to add a "#e" (execute) modifier.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root Scorecard

References

11 references

URL	Tags
http://www.securityfocus.com/bid/17695	vdb-entryx_refsource_BID
http://www.securityfocus.com/archive/1/432226/100…	mailing-listx_refsource_BUGTRAQ
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://www.securityfocus.com/archive/1/432451/100…	mailing-listx_refsource_BUGTRAQ
http://securityreason.com/securityalert/796	third-party-advisoryx_refsource_SREASON
http://secunia.com/advisories/19830	third-party-advisoryx_refsource_SECUNIA
http://www.vupen.com/english/advisories/2006/1534	vdb-entryx_refsource_VUPEN
http://www.securityfocus.com/archive/1/431990/100…	mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/archive/1/439607/100…	mailing-listx_refsource_BUGTRAQ
http://www.osvdb.org/25005	vdb-entryx_refsource_OSVDB
http://forums.invisionpower.com/index.php?showtop…	x_refsource_CONFIRM

Date Public

2006-04-25 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T17:35:31.193Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "17695",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/17695"
          },
          {
            "name": "20060427 Re: Invision Vulnerabilities, including remote code execution",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/432226/100/0/threaded"
          },
          {
            "name": "invision-search-file-include(26070)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26070"
          },
          {
            "name": "20060427 Invision Power Board 2.1.5 POC",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/432451/100/0/threaded"
          },
          {
            "name": "796",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/796"
          },
          {
            "name": "19830",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/19830"
          },
          {
            "name": "ADV-2006-1534",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/1534"
          },
          {
            "name": "20060425 Invision Vulnerabilities, including remote code execution",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/431990/100/0/threaded"
          },
          {
            "name": "20060710 Re: RE: Invision Vulnerabilities, including remote code execution",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/439607/100/0/threaded"
          },
          {
            "name": "25005",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/25005"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://forums.invisionpower.com/index.php?showtopic=213374"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-04-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "action_public/search.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary PHP code via a search with a crafted value of the lastdate parameter, which alters the behavior of a regular expression to add a \"#e\" (execute) modifier."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-18T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "17695",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/17695"
        },
        {
          "name": "20060427 Re: Invision Vulnerabilities, including remote code execution",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/432226/100/0/threaded"
        },
        {
          "name": "invision-search-file-include(26070)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26070"
        },
        {
          "name": "20060427 Invision Power Board 2.1.5 POC",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/432451/100/0/threaded"
        },
        {
          "name": "796",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/796"
        },
        {
          "name": "19830",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/19830"
        },
        {
          "name": "ADV-2006-1534",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/1534"
        },
        {
          "name": "20060425 Invision Vulnerabilities, including remote code execution",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/431990/100/0/threaded"
        },
        {
          "name": "20060710 Re: RE: Invision Vulnerabilities, including remote code execution",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/439607/100/0/threaded"
        },
        {
          "name": "25005",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/25005"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://forums.invisionpower.com/index.php?showtopic=213374"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-2059",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "action_public/search.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary PHP code via a search with a crafted value of the lastdate parameter, which alters the behavior of a regular expression to add a \"#e\" (execute) modifier."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "17695",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/17695"
            },
            {
              "name": "20060427 Re: Invision Vulnerabilities, including remote code execution",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/432226/100/0/threaded"
            },
            {
              "name": "invision-search-file-include(26070)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26070"
            },
            {
              "name": "20060427 Invision Power Board 2.1.5 POC",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/432451/100/0/threaded"
            },
            {
              "name": "796",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/796"
            },
            {
              "name": "19830",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/19830"
            },
            {
              "name": "ADV-2006-1534",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/1534"
            },
            {
              "name": "20060425 Invision Vulnerabilities, including remote code execution",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/431990/100/0/threaded"
            },
            {
              "name": "20060710 Re: RE: Invision Vulnerabilities, including remote code execution",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/439607/100/0/threaded"
            },
            {
              "name": "25005",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/25005"
            },
            {
              "name": "http://forums.invisionpower.com/index.php?showtopic=213374",
              "refsource": "CONFIRM",
              "url": "http://forums.invisionpower.com/index.php?showtopic=213374"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-2059",
    "datePublished": "2006-04-26T20:00:00.000Z",
    "dateReserved": "2006-04-26T00:00:00.000Z",
    "dateUpdated": "2024-08-07T17:35:31.193Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2006-2059",
      "date": "2026-10-16",
      "epss": "0.08036",
      "percentile": "0.94724"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "n/a",
                "vendor": "n/a",
                "versions": [
                  {
                    "status": "affected",
                    "version": "n/a"
                  }
                ]
              }
            ],
            "source": "cve@mitre.org"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:invision_power_services:invision_power_board:2.1.5_2006-03-08:*:*:*:*:*:*:*",
                    "matchCriteriaId": "ED5116FA-C532-42DF-ABBD-193AD7B799A6",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "action_public/search.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary PHP code via a search with a crafted value of the lastdate parameter, which alters the behavior of a regular expression to add a \"#e\" (execute) modifier."
          }
        ],
        "id": "CVE-2006-2059",
        "lastModified": "2026-06-16T22:24:15.670",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "NONE",
                "baseScore": 5.0,
                "confidentialityImpact": "NONE",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 10.0,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ]
        },
        "published": "2006-04-26T20:06:00.000",
        "references": [
          {
            "source": "cve@mitre.org",
            "tags": [
              "Patch"
            ],
            "url": "http://forums.invisionpower.com/index.php?showtopic=213374"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/19830"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://securityreason.com/securityalert/796"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.osvdb.org/25005"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securityfocus.com/archive/1/431990/100/0/threaded"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securityfocus.com/archive/1/432226/100/0/threaded"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securityfocus.com/archive/1/432451/100/0/threaded"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securityfocus.com/archive/1/439607/100/0/threaded"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securityfocus.com/bid/17695"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.vupen.com/english/advisories/2006/1534"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26070"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "http://forums.invisionpower.com/index.php?showtopic=213374"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/19830"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://securityreason.com/securityalert/796"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.osvdb.org/25005"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/archive/1/431990/100/0/threaded"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/archive/1/432226/100/0/threaded"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/archive/1/432451/100/0/threaded"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/archive/1/439607/100/0/threaded"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/bid/17695"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.vupen.com/english/advisories/2006/1534"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26070"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-Other"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

CERTA-2006-AVI-181

Vulnerability from certfr_avis - Published: 2006-05-04 - Updated: 2006-05-04

None

Description

De multiples vulnérabilités affectant le forum Invision Power Board ont été découvertes. Leur exploitation permet l'exécution de code arbitraire à distance.

Solution

Passer en version 2.1.5 ou appliquer le correctif pour la version 2.1.5 indiqué dans le message posté sur le forum d'Invision Power (cf. section Documentation).

Invision Power Board versions antérieures à 2.1.5. La version 2.1.5 est vulnérable si elle est antérieure au 25 avril 2006.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

EUVD-2026-140358

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 06:35

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T06:35:13.522894+00:00",
  "id": "EUVD-2026-140358"
}

FKIE_CVE-2006-2059

Vulnerability from fkie_nvd - Published: 2006-04-26 20:06 - Updated: 2026-06-16 22:24

Severity

Summary

References

URL	Tags
cve@mitre.org	http://forums.invisionpower.com/index.php?showtopic=213374	Patch
cve@mitre.org	http://secunia.com/advisories/19830
cve@mitre.org	http://securityreason.com/securityalert/796
cve@mitre.org	http://www.osvdb.org/25005
cve@mitre.org	http://www.securityfocus.com/archive/1/431990/100/0/threaded
cve@mitre.org	http://www.securityfocus.com/archive/1/432226/100/0/threaded
cve@mitre.org	http://www.securityfocus.com/archive/1/432451/100/0/threaded
cve@mitre.org	http://www.securityfocus.com/archive/1/439607/100/0/threaded
cve@mitre.org	http://www.securityfocus.com/bid/17695
cve@mitre.org	http://www.vupen.com/english/advisories/2006/1534
cve@mitre.org	https://exchange.xforce.ibmcloud.com/vulnerabilities/26070
af854a3a-2127-422b-91ae-364da2661108	http://forums.invisionpower.com/index.php?showtopic=213374	Patch
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/19830
af854a3a-2127-422b-91ae-364da2661108	http://securityreason.com/securityalert/796
af854a3a-2127-422b-91ae-364da2661108	http://www.osvdb.org/25005
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/archive/1/431990/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/archive/1/432226/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/archive/1/432451/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/archive/1/439607/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/17695
af854a3a-2127-422b-91ae-364da2661108	http://www.vupen.com/english/advisories/2006/1534
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/26070

Impacted products

	Vendor	Product	Version
	invision_power_services	invision_power_board	2.1.5_2006-03-08

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:invision_power_services:invision_power_board:2.1.5_2006-03-08:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED5116FA-C532-42DF-ABBD-193AD7B799A6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "action_public/search.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary PHP code via a search with a crafted value of the lastdate parameter, which alters the behavior of a regular expression to add a \"#e\" (execute) modifier."
    }
  ],
  "id": "CVE-2006-2059",
  "lastModified": "2026-06-16T22:24:15.670",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2006-04-26T20:06:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://forums.invisionpower.com/index.php?showtopic=213374"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/19830"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/796"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.osvdb.org/25005"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/431990/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/432226/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/432451/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/439607/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/17695"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2006/1534"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26070"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://forums.invisionpower.com/index.php?showtopic=213374"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/19830"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/796"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/25005"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/431990/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/432226/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/432451/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/439607/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/17695"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2006/1534"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26070"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-7643-2VRR-4H64

Vulnerability from github – Published: 2022-05-01 06:55 – Updated: 2022-05-01 06:55

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2006-2059"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2006-04-26T20:06:00Z",
    "severity": "MODERATE"
  },
  "details": "action_public/search.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary PHP code via a search with a crafted value of the lastdate parameter, which alters the behavior of a regular expression to add a \"#e\" (execute) modifier.",
  "id": "GHSA-7643-2vrr-4h64",
  "modified": "2022-05-01T06:55:21Z",
  "published": "2022-05-01T06:55:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-2059"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26070"
    },
    {
      "type": "WEB",
      "url": "http://forums.invisionpower.com/index.php?showtopic=213374"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/19830"
    },
    {
      "type": "WEB",
      "url": "http://securityreason.com/securityalert/796"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/25005"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/431990/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/432226/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/432451/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/439607/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/17695"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2006/1534"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GSD-2006-2059

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2006-2059

Aliases

CVE-2006-2059

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2006-2059",
    "description": "action_public/search.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary PHP code via a search with a crafted value of the lastdate parameter, which alters the behavior of a regular expression to add a \"#e\" (execute) modifier.",
    "id": "GSD-2006-2059"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2006-2059"
      ],
      "details": "action_public/search.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary PHP code via a search with a crafted value of the lastdate parameter, which alters the behavior of a regular expression to add a \"#e\" (execute) modifier.",
      "id": "GSD-2006-2059",
      "modified": "2023-12-13T01:19:52.478386Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2006-2059",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "action_public/search.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary PHP code via a search with a crafted value of the lastdate parameter, which alters the behavior of a regular expression to add a \"#e\" (execute) modifier."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "17695",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/17695"
          },
          {
            "name": "20060427 Re: Invision Vulnerabilities, including remote code execution",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/432226/100/0/threaded"
          },
          {
            "name": "invision-search-file-include(26070)",
            "refsource": "XF",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26070"
          },
          {
            "name": "20060427 Invision Power Board 2.1.5 POC",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/432451/100/0/threaded"
          },
          {
            "name": "796",
            "refsource": "SREASON",
            "url": "http://securityreason.com/securityalert/796"
          },
          {
            "name": "19830",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/19830"
          },
          {
            "name": "ADV-2006-1534",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2006/1534"
          },
          {
            "name": "20060425 Invision Vulnerabilities, including remote code execution",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/431990/100/0/threaded"
          },
          {
            "name": "20060710 Re: RE: Invision Vulnerabilities, including remote code execution",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/439607/100/0/threaded"
          },
          {
            "name": "25005",
            "refsource": "OSVDB",
            "url": "http://www.osvdb.org/25005"
          },
          {
            "name": "http://forums.invisionpower.com/index.php?showtopic=213374",
            "refsource": "CONFIRM",
            "url": "http://forums.invisionpower.com/index.php?showtopic=213374"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:invision_power_services:invision_power_board:2.1.5_2006-03-08:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-2059"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "action_public/search.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary PHP code via a search with a crafted value of the lastdate parameter, which alters the behavior of a regular expression to add a \"#e\" (execute) modifier."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://forums.invisionpower.com/index.php?showtopic=213374",
              "refsource": "CONFIRM",
              "tags": [
                "Patch"
              ],
              "url": "http://forums.invisionpower.com/index.php?showtopic=213374"
            },
            {
              "name": "17695",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/17695"
            },
            {
              "name": "25005",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://www.osvdb.org/25005"
            },
            {
              "name": "19830",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/19830"
            },
            {
              "name": "796",
              "refsource": "SREASON",
              "tags": [],
              "url": "http://securityreason.com/securityalert/796"
            },
            {
              "name": "ADV-2006-1534",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2006/1534"
            },
            {
              "name": "invision-search-file-include(26070)",
              "refsource": "XF",
              "tags": [],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26070"
            },
            {
              "name": "20060710 Re: RE: Invision Vulnerabilities, including remote code execution",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/439607/100/0/threaded"
            },
            {
              "name": "20060427 Invision Power Board 2.1.5 POC",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/432451/100/0/threaded"
            },
            {
              "name": "20060427 Re: Invision Vulnerabilities, including remote code execution",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/432226/100/0/threaded"
            },
            {
              "name": "20060425 Invision Vulnerabilities, including remote code execution",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/431990/100/0/threaded"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2018-10-18T16:37Z",
      "publishedDate": "2006-04-26T20:06Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2006-2059 (GCVE-0-2006-2059)

CERTA-2006-AVI-181

Description

Solution

EUVD-2026-140358

FKIE_CVE-2006-2059

GHSA-7643-2VRR-4H64

GSD-2006-2059

Tags

Sightings

Nomenclature

Related by attack behaviour