Invision Community 4.7.20 – (calendar/view.php) SQL Injection

• Exploit Database
• 11 阅读

• 作者： Egidio Romano
  日期： 2025-07-28
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/52383/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45

  # Exploit Title: Invision Community <= 4.7.20 (calendar/view.php) - SQL Injection # Google Dork: N/A # Date: 23 July 2025 # Exploit Author: Egidio Romano # LinkedIn: N/A # Vendor Homepage: https://invisioncommunity.com # Software Link: https://invisioncommunity.com # Version: Certain 4.x versions before 4.7.21 # Tested on: Invision Community <= 4.7.20 # CVE: CVE-2025-48932   ## Vulnerability Description   The vulnerability is located within the `/applications/calendar/modules/front/calendar/view.php` script. Specifically, in the `IPS\calendar\modules\front\calendar\view::search()` method, user input passed through the `location` request parameter is not properly sanitized before being used to construct a SQL query. This can be exploited by remote, unauthenticated attackers to, for example, read sensitive data from the database through boolean-based SQL Injection attacks. Successful exploitation of this vulnerability requires the "calendar" application to be installed and a "GeoLocation feature" (like Google Maps) to be configured.   **NOTE:** SQL Injection vulnerabilities in Invision Community 4.x might lead to admin account takeover and RCE attacks, by resetting the admin&apos;s password. However, starting from version 4.7.18, a new security encryption key has been introduced within the password reset mechanism. As such, this attack vector won&apos;t work anymore with versions >= 4.7.18.   ## Proof of Concept   https://karmainsecurity.com/pocs/CVE-2025-48932.php   ## Solution   Upgrade to version 4.7.21 or later.   ## Disclosure Timeline   - [16/05/2025] - Vendor notified - [27/05/2025] - Version 4.7.21 released - [28/05/2025] - CVE identifier requested - [28/05/2025] - CVE identifier assigned - [23/07/2025] - Public disclosure   ## CVE Reference   The Common Vulnerabilities and Exposures program (cve.org) has assigned the name CVE-2025-48932 to this vulnerability.   ## Credits   Vulnerability discovered by Egidio Romano.   ## Original Advisory   http://karmainsecurity.com/KIS-2025-06