Security Advisory

CVE-2024-30162

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2024-06-07 00:00:00

Last updated 2024-08-02 01:25:03

Assigner mitre

State PUBLISHED

Description

Invision Community through 4.7.16 allows remote code execution via the applications/core/modules/admin/editor/toolbar.php IPScoremodulesadmineditor_toolbar::addPlugin() method. This method handles uploaded ZIP files that are extracted into the applications/core/interface/ckeditor/ckeditor/plugins/ directory without properly verifying their content. This can be exploited by admin users (with the toolbar_manage permission) to write arbitrary PHP files into that directory, leading to execution of arbitrary PHP code in the context of the web server user.

← Browse all CVEs View on cve.org ↗