The version of Invision Power Board installed on the remote host does not properly sanitize HTML tags, which enables a remote attacker to inject a malicious IFRAME when posting a message to one of the hosted forums. Upgrade to Invision Power Board 2.0.3 or later. Plugin Details. Severity: Low. File Name: invisionpowerboard.
Invision Power Board (abbreviated IPB or IP.Board) is an Internet forum software produced by Invision Power Services, Inc. Written in PHP and primarily using MySQL (other database engines are available), it is comparable to other forum software such as phpBB, UBB.threads, vBulletin and MyBulletinBoard.
While Invision Power Board is a commercially sold product, there is a large modding community and many of these modifications are free. In addition, many groups offer the download or design of free and paid-for skins.
History
Invision Power Services (IPS) was begun by Matt Mecham and Charles Warner in 2002, after the pair left Jarvis Entertainment Group (who produced Ikonboard). Their first product was IPB, another forum package, which quickly gathered a community of former Ikonboard users.
Although the software developers originally maintained that it would remain a free package, in 2004 IPB ended its free releases for non-commercial uses. A downloadable trial version of Invision Power Board 2.0.0, 2.0.2, and 2.0.3 versions were made available, but were discontinued on September 27, 2004. It was replaced with a free demo, thus ending its claims that IPB will be free forever. On July 1, 2005, IPS changed the demo timeframe from 15 days to 5 days, and a few months later, it was again reduced to 24 hours.
IPB 2.1 was released on September 13, 2005. The administrator's control panel was completely redesigned, and the posting options were renovated to feature viewable text properties (Rich Text Editor), such as bold, italics, underline, etc. The viewing styles were also redone, and a number of various other changes were made including the use of Ajax in many new features.
Version 1.3
Version 1.3 was the last free version, and IPS still permits it to be used, but does not offer a download or support. Regardless of the lack of help, many users still ulteiize the older version, even though it has known security holes. Up until 2005, IPS offered security fixes, but with the advent of version 2.1, these have ceased.
Latest Releases
2.0.x (obsolete) - 2.0.4: May 4, 2005
2.1.x (stable) - 2.1.5: March 1, 2006
2.1.x (stable) - 2.1.6: May 3, 2006 |
|
Thanks pringlex for this news in the forums.
This from the InvisionPowerBoard website:Audi a6 mmi manual. We're pleased to announce that the final production release of 1.3 has been released to the download area.
This release fixes up the last few issues found in our pre release version. This version is fully supported by our technicians and if you require an upgrade, please go into your client center and start a new ticket requesting an upgrade. Please allow us a little extra time to complete your order as there is always a large influx of orders around a final release.
There are no skin or language changes from the pre final release. If you are upgrading from earlier versions of Invision Power Board, you may wish to log into your download area (use the same username and password as you use here) and view the 'docs' section to compile a list of changed files.
If you are upgrading from 1.2, we recommend that you upload ALL of the IPB source files EXCEPT conf_global.php - it's very important that you don't upload that file from the download zip. You will also need to run 'upgrade6.php' if you are upgrading from 1.2 - this can be found in the 'Tools and Scripts' folder of the download zip.
Download: Invision Power Board 1.3
Download: Registered users upgrade
Guide to science asimov. News source: Invision Power Board
