Proof‑of‑concept description for CVE‑2025‑47916, a Remote Code Execution vulnerability affecting Invision Community 5.0.0–5.0.6 via unsafe template processing in the "customCss()" method.# CVE-2025-47916 - Invision Community Remote Code Execution (RCE) Vulnerability
## About
This repository provides a proof‑of‑concept description for
**CVE‑2025‑47916**, a Remote Code Execution vulnerability affecting
Invision Community versions **5.0.0 through 5.0.6**. The issue stems
from improper handling of user-supplied input within the `customCss()`
method, allowing unauthenticated attackers to execute crafted template
expressions.
## Affected Versions
- All versions from **5.0.0** to **5.0.6**
## Description
The vulnerability resides in the
`IPS\core\modules\front\system\themeeditor::customCss()` method inside:
/applications/core/modules/front/system/themeeditor.php
The method can be called without authentication and passes the `content`
request parameter to `Theme::makeProcessFunction()`. Since the value is
processed through the template engine, specially crafted input may lead
to **arbitrary PHP code execution**. This enables remote,
unauthenticated attackers to achieve full code execution within the
Invision Community environment.
## CLI Usage
usage: main.py [options] target
positional arguments:
target Target URL
optional arguments:
-p, --proxy PROXY Proxy server to route requests
-c, --command CMD Single command to process (for testing output handling)
-t, --test Perform a non-intrusive vulnerability check
## Solution
Update to **Invision Community 5.0.7** or later, where the issue has
been resolved.
## Credits
Vulnerability discovered by **Egidio Romano**.
## References
- https://invisioncommunity.com/release-notes-v5/507-r41/
- CVE entry
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47916
- Karma In Security Advisory:
https://karmainsecurity.com/KIS-2025-02
登录后查看神龙缓存的 POC 文件快照
登录查看