CVE-2016-6174
HIGHInvision Power Board < 4.1.13 - Remote Code Execution via content_class Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2016-6174. PoCs published by Egidio Romano.
AI-analyzed exploit summary This exploit leverages an unsanitized user input in the 'content_class' parameter to inject arbitrary PHP code via the autoloading mechanism in IPS Community Suite. The vulnerability is triggered by a crafted URL that executes PHP code within the context of the application.
Description
applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.1.13, when used with PHP before 5.4.24 or 5.5.x before 5.5.8, allows remote attackers to execute arbitrary code via the content_class parameter.
Exploits (1)
This exploit leverages an unsanitized user input in the 'content_class' parameter to inject arbitrary PHP code via the autoloading mechanism in IPS Community Suite. The vulnerability is triggered by a crafted URL that executes PHP code within the context of the application.
References (8)
Scores
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H