CVE-2025-47916

This repository contains a functional exploit for CVE-2025-47916, an unauthenticated RCE vulnerability in Invision Community 5.0.0-5.0.6. The exploit leverages improper template engine handling in the `customCss()` method to execute arbitrary PHP code via crafted input.

This repository contains functional exploit code for CVE-2025-47916, an unauthenticated RCE vulnerability in Invision Community 5.0.0-5.0.6 via template injection. It includes multiple PoC scripts demonstrating OS command execution, PHP eval, and web shell deployment, along with a Docker-based lab environment for testing.

This PHP script exploits a remote code execution vulnerability in Invision Community <= 5.0.6 by injecting a malicious expression into the 'content' parameter of the theme editor, allowing arbitrary command execution. The exploit uses cURL to send crafted POST requests and retrieves command output via a delimiter-based extraction.

This Metasploit module exploits a remote code execution vulnerability in Invision Community up to version 5.0.6 by injecting a malicious expression into the `customCss` endpoint, allowing arbitrary PHP execution.