Description
applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.1.13, when used with PHP before 5.4.24 or 5.5.x before 5.5.8, allows remote attackers to execute arbitrary code via the content_class parameter.
Exploits (1)
References (8)
Core 8
Core References
Exploit mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2016/Jul/19
Mailing List vendor-advisory
x_refsource_apple
http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html
Exploit, Third Party Advisory exploit
x_refsource_exploit-db
https://www.exploit-db.com/exploits/40084/
Exploit, Third Party Advisory x_refsource_misc
http://packetstormsecurity.com/files/137804/IPS-Community-Suite-4.1.12.3-PHP-Code-Injection.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/91732
Exploit x_refsource_misc
http://karmainsecurity.com/KIS-2016-11
Various Sources x_refsource_confirm
https://invisionpower.com/release-notes/4113-r44/
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT207170
Scores
CVSS v3
8.1
EPSS
0.1983
EPSS Percentile
95.5%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
Status
published
Products (10)
invisioncommunity/invision_power_board
< 4.1.12.3
php/php
5.5.0 (13 CPE variants)
php/php
5.5.1
php/php
5.5.2
php/php
5.5.3
php/php
5.5.4
php/php
5.5.5
php/php
5.5.6
php/php
5.5.7
php/php
< 5.4.23
Published
Jul 12, 2016
Tracked Since
Feb 18, 2026