THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)

Ok

PUBLISHED

CVE-2024-30162

Reserved:2024-03-24
Published:2024-06-07
Updated:2024-06-10

Description

Invision Community through 4.7.16 allows remote code execution via the applications/core/modules/admin/editor/toolbar.php IPS\core\modules\admin\editor\_toolbar::addPlugin() method. This method handles uploaded ZIP files that are extracted into the applications/core/interface/ckeditor/ckeditor/plugins/ directory without properly verifying their content. This can be exploited by admin users (with the toolbar_manage permission) to write arbitrary PHP files into that directory, leading to execution of arbitrary PHP code in the context of the web server user.

References

https://invisioncommunity.com

http://seclists.org/fulldisclosure/2024/Apr/21

cve.org CVE-2024-30162

nvd.nist.gov CVE-2024-30162

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-30162