CVE-2021-32924
published 2021-06-01CVE-2021-32924: Invision Community (aka IPS Community Suite) before 4.6.0 allows eval-based PHP code injection by a moderator because the…
PriorityP262high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
19.91%
97.1th percentile
Invision Community (aka IPS Community Suite) before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\_builder::previewBlock method interacts unsafely with the IPS\_Theme::runProcessFunction method.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| invisioncommunity | ips_community_suite | < 4.6.0 | 4.6.0 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://karmainsecurity.com/KIS-2021-04http://packetstormsecurity.com/files/162868/IPS-Community-Suite-4.5.4.2-PHP-Code-Injection.htmlhttp://seclists.org/fulldisclosure/2021/May/80https://hackerone.com/reports/1092574https://invisioncommunity.com/features/security/http://karmainsecurity.com/KIS-2021-04http://packetstormsecurity.com/files/162868/IPS-Community-Suite-4.5.4.2-PHP-Code-Injection.htmlhttp://seclists.org/fulldisclosure/2021/May/80https://hackerone.com/reports/1092574https://invisioncommunity.com/features/security/
2021-06-01
Published