[KIS-2024-02] Invision Community <= 4.7.15 (store.php) SQL Injection Vulnerability

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->
<a href="/fulldisclosure/"><img src="/images/fulldisclosure-logo.png" class="l-logo right" alt="fulldisclosure logo" width="80"></a>
<h2 class="m-list"><a href="/fulldisclosure/">Full Disclosure</a>
mailing list archives</h2>
<!--X-User-Header-End-->
<!--X-TopPNI-->
<div class="nav-bar">
<div class="nav-link">
<a href="19"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="date.html#20">By Date</a>
<a href="21"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<div class="nav-link">
<a href="19"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="index.html#20">By Thread</a>
<a href="21"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<form class="nst-search center" action="/search/fulldisclosure">
<input class="nst-search-q" name="q" type="search" placeholder="List Archive Search">
<button class="nst-search-button" title="Search">
<img style="width:100%;aspect-ratio:1/1;" alt="" aria-hidden="true" src="/shared/images/nst-icons.svg#search">
</button>
</form>

</div>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
<h1 class="m-title">[KIS-2024-02] Invision Community &lt;= 4.7.15 (store.php) SQL	Injection Vulnerability</h1>
<hr>
<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->


<em>From</em>: Egidio Romano &lt;n0b0d13s () gmail com&gt;


<em>Date</em>: Fri, 5 Apr 2024 20:36:54 +0200


<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->
<hr>
<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
<pre style="margin: 0em;">--------------------------------------------------------------------
Invision Community &lt;= 4.7.15 (store.php) SQL Injection Vulnerability
--------------------------------------------------------------------


[-] Software Link:

<a rel="nofollow" href="https://invisioncommunity.com">https://invisioncommunity.com</a>


[-] Affected Versions:

All versions from 4.4.0 to 4.7.15.


[-] Vulnerability Description:

The vulnerability is located in the
/applications/nexus/modules/front/store/store.php script.
Specifically, into the
IPS\nexus\modules\front\store\_store::_categoryView() method:

126 /* Apply Filters */
127 if ( isset( \IPS\Request::i()-&gt;filter ) and \is_array(
\IPS\Request::i()-&gt;filter ) )
128 {
129 $url = $url-&gt;setQueryString( 'filter', \IPS\Request::i()-&gt;filter );
130 foreach ( \IPS\Request::i()-&gt;filter as $filterId =&gt; $allowedValues )
131 {
132 $where[] = array( \IPS\Db::i()-&gt;findInSet(
"filter{$filterId}.pfm_values", array_map( 'intval', explode( ',',
$allowedValues ) ) ) );
133 $joins[] = array( 'table' =&gt; array( 'nexus_package_filters_map',
"filter{$filterId}" ), 'on' =&gt; array(
"filter{$filterId}.pfm_package=p_id AND
filter{$filterId}.pfm_filter=?", $filterId ) );
134 }
135 }

User input passed through the "filter" request parameter is not
properly sanitized before being
assigned to the $where and $joins variables (lines 132 and 133), which
are later used to execute
some SQL queries. This can be exploited by unauthenticated attackers
to carry out time-based or
error-based Blind SQL Injection attacks. Subsequently, this might also
be exploited to reset
users' passwords and gain unauthorized access to the AdminCP, in order
to achieve
Remote Code Execution (RCE). Successful exploitation of this
vulnerability requires
the nexus application to be installed and configured with one "Product
Group" at least.


[-] Proof of Concept:

<a rel="nofollow" href="https://karmainsecurity.com/pocs/CVE-2024-30163.php">https://karmainsecurity.com/pocs/CVE-2024-30163.php</a>


[-] Solution:

Upgrade to version 4.7.16 or later.


[-] Disclosure Timeline:

[08/01/2024] - Vulnerability details sent to SSD Secure Disclosure
[12/03/2024] - Version 4.7.16 released
[20/03/2024] - CVE identifier requested
[24/03/2024] - CVE identifier assigned
[05/04/2024] - Coordinated public disclosure


[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2024-30163 to this vulnerability.


[-] Credits:

Vulnerability discovered by Egidio Romano.


[-] Other References:

<a rel="nofollow" href="https://invisioncommunity.com/release-notes/4716-r128/">https://invisioncommunity.com/release-notes/4716-r128/</a>
<a rel="nofollow" href="https://ssd-disclosure.com/ssd-advisory-ip-board-nexus-rce-and-blind-sqli/">https://ssd-disclosure.com/ssd-advisory-ip-board-nexus-rce-and-blind-sqli/</a>


[-] Original Advisory:

<a rel="nofollow" href="http://karmainsecurity.com/KIS-2024-02">http://karmainsecurity.com/KIS-2024-02</a>
_______________________________________________
Sent through the Full Disclosure mailing list
<a rel="nofollow" href="https://nmap.org/mailman/listinfo/fulldisclosure">https://nmap.org/mailman/listinfo/fulldisclosure</a>
Web Archives &amp; RSS: <a rel="nofollow" href="https://seclists.org/fulldisclosure/">https://seclists.org/fulldisclosure/</a>

</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->
<div class="nav-bar">
<div class="nav-link">
<a href="19"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="date.html#20">By Date</a>
<a href="21"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<div class="nav-link">
<a href="19"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="index.html#20">By Thread</a>
<a href="21"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
</div>
<h3 class="m-thread">Current thread:</h3>
<ul class="thread">
<li><strong>[KIS-2024-02] Invision Community &lt;= 4.7.15 (store.php) SQL	Injection Vulnerability</strong> <em>Egidio Romano (Apr 10)</em>
</li></ul>


<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
<p>