Invision Community vulnerable to SQL Injection via store.php method

CVE-2024-30163

What is CVE-2024-30163?

Invision Community software versions prior to 4.7.16 are susceptible to a SQL injection vulnerability. An attacker can exploit this weakness through the applications/nexus/modules/front/store/store.php file, specifically within the _categoryView() method. The vulnerability arises from the inadequate sanitization of user input passed through the filter request parameter, allowing unauthenticated attackers to execute Blind SQL Injection attacks. Such exploits could lead to unauthorized access to sensitive data stored in the database, emphasizing the necessity for users to upgrade to the latest version to mitigate this risk. For further details, refer to the official release notes and security discussions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References