CVE-2016-6174

published 2016-07-12

CVE-2016-6174: applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before…

Priority P2 64 high 8.1 CVSS 3.0

AV N AC H PR N UI N S U C H I H A H

EXPLOIT

applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.1.13, when used with PHP before 5.4.24 or 5.5.x before 5.5.8, allows remote attackers to execute arbitrary code via the content_class parameter.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
apple	macos_sierra	—	—
invisioncommunity	invision_power_board	<= 4.1.12.3	—
php	php	<= 5.4.23	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—
php	php	—	—

Detection & IOCs extracted from sources · hover to see the quote

url index.php?app=core&module=system&controller=content&do=find&content_class=cms\Fields1{}phpinfo();/*↗

path applications/core/modules/front/system/content.php↗

path /applications/cms/Application.php↗

• → Monitor HTTP requests for the 'content_class' parameter containing namespace separator characters, curly braces, or PHP function calls (e.g. 'cms\Fields' followed by digits and injected PHP code), targeting the endpoint app=core&module=system&controller=content&do=find ↗
• → Alert on HTTP requests where 'content_class' parameter value matches the pattern 'cms\Fields<digit>{...}' as this triggers the vulnerable eval() code path in Application.php ↗
• → Exploitation is only possible against IPS Community Suite running on PHP < 5.4.24 or PHP 5.5.x < 5.5.8; fingerprint target PHP version to prioritize triage ↗

• · Exploitation requires the CMS application to be installed and active, as the vulnerable autoloader is defined in /applications/cms/Application.php — instances without the CMS app are not exploitable via this vector ↗
• · The vulnerability is only exploitable on PHP versions before 5.4.24 or 5.5.x before 5.5.8; modern PHP versions are not affected ↗
• · The attack is unauthenticated — no session or login is required for exploitation ↗

CVSS provenance

nvd v3.0 8.1 HIGH CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.