what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

IPS Community Suite 4.5.4.2 PHP Code Injection

IPS Community Suite 4.5.4.2 PHP Code Injection
Posted May 31, 2021
Authored by EgiX | Site karmainsecurity.com

IPS Community Suite versions 4.5.4.2 and below suffer from a PHP code injection vulnerability. The vulnerability exists because the IPS\cms\modules\front\pages\_builder::previewBlock() method allows to pass arbitrary content to the IPS\_Theme::runProcessFunction() method, which will be used in a call to the eval() PHP function. This can be exploited to inject and execute arbitrary PHP code. Successful exploitation of this vulnerability requires an account with permission to manage the sidebar (such as a Moderator or Administrator) and the "cms" application to be enabled.

tags | exploit, arbitrary, php
advisories | CVE-2021-32924
SHA-256 | 392b40ad40c330e4deb04c99f4ff988666d96d0c4e3c606a17ec99241047911a

IPS Community Suite 4.5.4.2 PHP Code Injection

Change Mirror Download
------------------------------------------------------------------------------
IPS Community Suite <= 4.5.4.2 (previewBlock) PHP Code Injection
Vulnerability
------------------------------------------------------------------------------


[-] Software Link:

https://invisioncommunity.com


[-] Affected Versions:

Version 4.5.4.2 and prior versions.


[-] Vulnerability Description:

The vulnerability exists because the
IPS\cms\modules\front\pages\_builder::previewBlock() method allows to
pass arbitrary content to the IPS\_Theme::runProcessFunction() method,
which will be used in a call to the eval() PHP function. This can be
exploited to inject and execute arbitrary PHP code. Successful
exploitation of this vulnerability requires an account with permission
to manage the sidebar (such as a Moderator or Administrator) and the
"cms" application to be enabled.


[-] Proof of Concept:

http://[host]/[ips]/index.php?app=cms&module=pages&controller=builder&do=previewBlock&block_plugin=stats&block_template_use_how=copy&block_plugin_app=core&_sending=block_content&block_content=RCE%0ACONTENT;}}phpinfo();die;/*


[-] Solution:

Apply the vendor patch or upgrade to version 4.6.0 or later.


[-] Disclosure Timeline:

[02/02/2021] - Vendor notified through HackerOne
[02/04/2021] - Asked for an update
[06/04/2021] - Vendor replies they already released a targeted patch
[13/05/2021] - CVE number assigned
[28/05/2021] - Public disclosure


[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2021-32924 to this vulnerability.


[-] Credits:

Vulnerability discovered by Egidio Romano.


[-] Other References:

https://hackerone.com/reports/1092574


[-] Original Advisory:

http://karmainsecurity.com/KIS-2021-04
Login or Register to add favorites

File Archive:

September 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    261 Files
  • 2
    Sep 2nd
    17 Files
  • 3
    Sep 3rd
    38 Files
  • 4
    Sep 4th
    52 Files
  • 5
    Sep 5th
    23 Files
  • 6
    Sep 6th
    27 Files
  • 7
    Sep 7th
    0 Files
  • 8
    Sep 8th
    1 Files
  • 9
    Sep 9th
    16 Files
  • 10
    Sep 10th
    38 Files
  • 11
    Sep 11th
    21 Files
  • 12
    Sep 12th
    40 Files
  • 13
    Sep 13th
    18 Files
  • 14
    Sep 14th
    0 Files
  • 15
    Sep 15th
    0 Files
  • 16
    Sep 16th
    21 Files
  • 17
    Sep 17th
    51 Files
  • 18
    Sep 18th
    23 Files
  • 19
    Sep 19th
    0 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close