Secunia

A vulnerability has been identified in Invision Power Board allowing malicious local users to alter files.

The problem is that all ".php" files and all folders are created with group write access. This could potentially be exploited by other members of the group to alter the files and execute arbitrary code with privileges of the web server process.

This has been confirmed in version 1.1.1 and 1.1.2.

Solution
Change the permissions so that files and folders are only writeable for the owner or trusted users.

Provided and/or discovered by
f3rm0r

Deep Links
Links available in Customer Area