Invisioncommunity < 5.0.7 - Remote Code Execution
Title source: ruleExploitation Summary
CVE-2025-47916 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 4 public exploits from researchers including Egidio Romano, exploitintel, Web3-Serializer, including a Metasploit module exploits/multi/http/invision_customcss_rce.
A Nuclei detection template is also available.
AI-analyzed exploit summary This PHP script exploits a remote code execution vulnerability in Invision Community <= 5.0.6 by injecting a malicious expression into the 'content' parameter of the theme editor, allowing arbitrary command execution. The exploit uses cURL to send crafted POST requests and retrieves command output via a delimiter-based extraction.
Description
Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method; hence it is evaluated by the template engine. Accordingly, this can be exploited by unauthenticated attackers to inject and execute arbitrary PHP code by providing crafted template strings.
Exploits (4)
This PHP script exploits a remote code execution vulnerability in Invision Community <= 5.0.6 by injecting a malicious expression into the 'content' parameter of the theme editor, allowing arbitrary command execution. The exploit uses cURL to send crafted POST requests and retrieves command output via a delimiter-based extraction.
This repository contains functional exploit code for CVE-2025-47916, an unauthenticated RCE vulnerability in Invision Community 5.0.0-5.0.6 via template injection. It includes multiple PoC scripts demonstrating OS command execution, PHP eval, and web shell deployment, along with a Docker-based lab environment for testing.
This repository contains a functional exploit for CVE-2025-47916, an unauthenticated RCE vulnerability in Invision Community 5.0.0-5.0.6. The exploit leverages improper template engine handling in the `customCss()` method to execute arbitrary PHP code via crafted input.
This Metasploit module exploits a remote code execution vulnerability in Invision Community up to version 5.0.6 by injecting a malicious expression into the `customCss` endpoint, allowing arbitrary PHP execution.
Nuclei Templates (1)
Set-Cookie: ips4_
body="Invision" && body="ips4"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
