Invision Community vulnerable to SQL Injection via store.php method

CVE-2024-30163

What is CVE-2024-30163?

Invision Community software versions prior to 4.7.16 are susceptible to a SQL injection vulnerability. An attacker can exploit this weakness through the applications/nexus/modules/front/store/store.php file, specifically within the _categoryView() method. The vulnerability arises from the inadequate sanitization of user input passed through the filter request parameter, allowing unauthenticated attackers to execute Blind SQL Injection attacks. Such exploits could lead to unauthorized access to sensitive data stored in the database, emphasizing the necessity for users to upgrade to the latest version to mitigate this risk. For further details, refer to the official release notes and security discussions.

References