Invision Community <= 4.7.15 (store.php) SQL Injection Vulnerability

• Software Link:

• Affected Versions:

All versions from 4.4.0 to 4.7.15.

• Vulnerability Description:

The vulnerability is located in the /applications/nexus/modules/front/store/store.php script.

Specifically, into the IPS\nexus\modules\front\store\_store::_categoryView() method:

126		/* Apply Filters */
127		if ( isset( \IPS\Request::i()->filter ) and \is_array( \IPS\Request::i()->filter ) )
128		{
129			$url = $url->setQueryString( 'filter', \IPS\Request::i()->filter );
130			foreach ( \IPS\Request::i()->filter as $filterId => $allowedValues )
131			{
132				$where[] = array( \IPS\Db::i()->findInSet( "filter{$filterId}.pfm_values", array_map( 'intval', explode( ',', $allowedValues ) ) ) );
133				$joins[] = array( 'table' => array( 'nexus_package_filters_map', "filter{$filterId}" ), 'on' => array( "filter{$filterId}.pfm_package=p_id AND filter{$filterId}.pfm_filter=?", $filterId ) );
134			}
135		}

User input passed through the “filter” request parameter is not properly sanitized before being assigned to the $where and $joins variables (lines 132 and 133), which are later used to execute some SQL queries. This can be exploited by unauthenticated attackers to carry out time-based or error-based Blind SQL Injection attacks. Subsequently, this might also be exploited to reset users' passwords and gain unauthorized access to the AdminCP, in order to achieve Remote Code Execution (RCE).

Successful exploitation of this vulnerability requires the nexus application to be installed and configured with one “Product Group” at least.

• Proof of Concept:

https://karmainsecurity.com/pocs/CVE-2024-30163.php

• Solution:

Upgrade to version 4.7.16 or later.

• Disclosure Timeline:

[08/01/2024] – Vulnerability details sent to SSD Secure Disclosure

[12/03/2024] – Version 4.7.16 released

[20/03/2024] – CVE identifier requested

[24/03/2024] – CVE identifier assigned

[05/04/2024] – Coordinated public disclosure

• CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2024-30163 to this vulnerability.

• Credits:

Vulnerability discovered by Egidio Romano.

• Other References:

https://invisioncommunity.com/release-notes/4716-r128/

https://ssd-disclosure.com/ssd-advisory-ip-board-nexus-rce-and-blind-sqli/