Vulnerabilities > CVE-2016-6174 - PHP Code Injection vulnerability in IPS Community Suite

CVSS 6.8 - MEDIUM

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

PARTIAL

network

invisionpower

php

invisioncommunity

nessus

exploit available

NVD

Published: 2016-07-12

Updated: 2017-03-21

Summary

applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.1.13, when used with PHP before 5.4.24 or 5.5.x before 5.5.8, allows remote attackers to execute arbitrary code via the content_class parameter.

Vulnerable Configurations

Part	Description	Count
Application	Invisioncommunity Invisioncommunity Invision Power Board 2.0 Invisioncommunity Invision Power Board 3.0.0 Invisioncommunity Invision Power Board 3.0.1 Invisioncommunity Invision Power Board 3.0.2 Invisioncommunity Invision Power Board 3.0.4 Invisioncommunity Invision Power Board 3.1.2 Invisioncommunity Invision Power Board 3.3.0 Invisioncommunity Invision Power Board 3.3.1 Invisioncommunity Invision Power Board 3.3.2 Invisioncommunity Invision Power Board 3.3.3 Invisioncommunity Invision Power Board 3.3.4 Invisioncommunity Invision Power Board 3.4.0 Invisioncommunity Invision Power Board 3.4.1 Invisioncommunity Invision Power Board 3.4.2 Invisioncommunity Invision Power Board 3.4.3 Invisioncommunity Invision Power Board 3.4.4 Invisioncommunity Invision Power Board 3.4.5 Invisioncommunity Invision Power Board 3.4.6 Invisioncommunity Invision Power Board 3.4.7 Invisioncommunity Invision Power Board 3.4.8 Invisioncommunity Invision Power Board 4.0.0 Invisioncommunity Invision Power Board 4.0.1 Invisioncommunity Invision Power Board 4.0.2 Invisioncommunity Invision Power Board 4.0.3 Invisioncommunity Invision Power Board 4.0.4 Invisioncommunity Invision Power Board 4.0.5.1 Invisioncommunity Invision Power Board 4.0.6.1 Invisioncommunity Invision Power Board 4.0.7 Invisioncommunity Invision Power Board 4.0.8 Invisioncommunity Invision Power Board 4.0.8.1 Invisioncommunity Invision Power Board 4.0.9.2 Invisioncommunity Invision Power Board 4.0.10.2 Invisioncommunity Invision Power Board 4.0.11 Invisioncommunity Invision Power Board 4.0.12.1 Invisioncommunity Invision Power Board 4.0.13.1 Invisioncommunity Invision Power Board 4.1.0 Invisioncommunity Invision Power Board 4.1.1 Invisioncommunity Invision Power Board 4.1.2 Invisioncommunity Invision Power Board 4.1.3.1 Invisioncommunity Invision Power Board 4.1.3.2 Invisioncommunity Invision Power Board 4.1.4.1 Invisioncommunity Invision Power Board 4.1.5 Invisioncommunity Invision Power Board 4.1.5.1 Invisioncommunity Invision Power Board 4.1.5.2 Invisioncommunity Invision Power Board 4.1.6 Invisioncommunity Invision Power Board 4.1.6.1 Invisioncommunity Invision Power Board 4.1.7 Invisioncommunity Invision Power Board 4.1.8 Invisioncommunity Invision Power Board 4.1.8.1 Invisioncommunity Invision Power Board 4.1.9 Invisioncommunity Invision Power Board 4.1.10 Invisioncommunity Invision Power Board 4.1.11 Invisioncommunity Invision Power Board 4.1.11.1 Invisioncommunity Invision Power Board 4.1.12 Invisioncommunity Invision Power Board 4.1.12.1 Invisioncommunity Invision Power Board 4.1.12.2 Invisioncommunity Invision Power Board 4.1.12.3	71
Application	Php PHP PHP - PHP PHP 0.1 PHP PHP 0.1.1 PHP PHP 0.2 PHP PHP 0.2.0 PHP PHP 0.2.1 PHP PHP 0.2.2 PHP PHP 0.2.3 PHP PHP 0.2.4 PHP PHP 0.3 PHP PHP 0.4 PHP PHP 0.5 PHP PHP 0.5.2 PHP PHP 0.5.3 PHP PHP 0.6 PHP PHP 0.7 PHP PHP 0.9 PHP PHP 0.9.0 PHP PHP 0.9.1 PHP PHP 0.9.2 PHP PHP 0.9.3 PHP PHP 0.9.4 PHP PHP 0.10 PHP PHP 0.11 PHP PHP 0.90 PHP PHP 0.91 PHP PHP 1.0 PHP PHP 1.0.0 PHP PHP 1.0.1 PHP PHP 1.0.2 PHP PHP 1.0.3 PHP PHP 1.0.4 PHP PHP 1.1 PHP PHP 1.1.0 PHP PHP 1.1.1 PHP PHP 1.2 PHP PHP 1.2.0 PHP PHP 1.2.1 PHP PHP 1.2.2 PHP PHP 1.2.3 PHP PHP 1.2.4 PHP PHP 1.2.5 PHP PHP 1.3 PHP PHP 1.3.1 PHP PHP 1.3.5 PHP PHP 1.4 PHP PHP 1.5 PHP PHP 2.0 PHP PHP 2.0.0 PHP PHP 2.0.1 PHP PHP 2.0.2 PHP PHP 2.0B10 PHP PHP 3.0 PHP PHP 3.0.1 PHP PHP 3.0.2 PHP PHP 3.0.3 PHP PHP 3.0.4 PHP PHP 3.0.5 PHP PHP 3.0.6 PHP PHP 3.0.7 PHP PHP 3.0.8 PHP PHP 3.0.9 PHP PHP 3.0.10 PHP PHP 3.0.11 PHP PHP 3.0.12 PHP PHP 3.0.13 PHP PHP 3.0.14 PHP PHP 3.0.15 PHP PHP 3.0.16 PHP PHP 3.0.17 PHP PHP 3.0.18 PHP PHP 4.0 PHP PHP 4.0.0 PHP PHP 4.0.1 PHP PHP 4.0.2 PHP PHP 4.0.3 PHP PHP 4.0.4 PHP PHP 4.0.5 PHP PHP 4.0.6 PHP PHP 4.0.7 PHP PHP 4.1.0 PHP PHP 4.1.1 PHP PHP 4.1.2 PHP PHP 4.1.3 PHP PHP 4.2 PHP PHP 4.2.0 PHP PHP 4.2.1 PHP PHP 4.2.2 PHP PHP 4.2.3 PHP PHP 4.2.4 PHP PHP 4.3 PHP PHP 4.3.0 PHP PHP 4.3.1 PHP PHP 4.3.2 PHP PHP 4.3.3 PHP PHP 4.3.4 PHP PHP 4.3.5 PHP PHP 4.3.6 PHP PHP 4.3.7 PHP PHP 4.3.8 PHP PHP 4.3.9 PHP PHP 4.3.10 PHP PHP 4.3.11 PHP PHP 4.4.0 PHP PHP 4.4.1 PHP PHP 4.4.2 PHP PHP 4.4.3 PHP PHP 4.4.4 PHP PHP 4.4.5 PHP PHP 4.4.6 PHP PHP 4.4.7 PHP PHP 4.4.8 PHP PHP 4.4.9 PHP PHP 5.0.0 PHP PHP 5.0.1 PHP PHP 5.0.2 PHP PHP 5.0.3 PHP PHP 5.0.4 PHP PHP 5.0.5 PHP PHP 5.1 PHP PHP 5.1.0 PHP PHP 5.1.1 PHP PHP 5.1.2 PHP PHP 5.1.3 PHP PHP 5.1.4 PHP PHP 5.1.5 PHP PHP 5.1.6 PHP PHP 5.2.0 PHP PHP 5.2.1 PHP PHP 5.2.2 PHP PHP 5.2.3 PHP PHP 5.2.4 PHP PHP 5.2.5 PHP PHP 5.2.6 PHP PHP 5.2.7 PHP PHP 5.2.8 PHP PHP 5.2.9 PHP PHP 5.2.10 PHP PHP 5.2.11 PHP PHP 5.2.12 PHP PHP 5.2.13 PHP PHP 5.2.14 PHP PHP 5.2.15 PHP PHP 5.2.16 PHP PHP 5.2.17 PHP PHP 5.3.0 PHP PHP 5.3.1 PHP PHP 5.3.2 PHP PHP 5.3.3 PHP PHP 5.3.4 PHP PHP 5.3.5 PHP PHP 5.3.6 PHP PHP 5.3.7 PHP PHP 5.3.8 PHP PHP 5.3.9 PHP PHP 5.3.10 PHP PHP 5.3.11 PHP PHP 5.3.12 PHP PHP 5.3.13 PHP PHP 5.3.14 PHP PHP 5.3.15 PHP PHP 5.3.16 PHP PHP 5.3.17 PHP PHP 5.3.18 PHP PHP 5.3.19 PHP PHP 5.3.20 PHP PHP 5.3.21 PHP PHP 5.3.22 PHP PHP 5.3.23 PHP PHP 5.3.24 PHP PHP 5.3.25 PHP PHP 5.3.26 PHP PHP 5.3.27 PHP PHP 5.3.28 PHP PHP 5.3.29 PHP PHP 5.4.0 PHP PHP 5.4.1 PHP PHP 5.4.2 PHP PHP 5.4.3 PHP PHP 5.4.4 PHP PHP 5.4.5 PHP PHP 5.4.6 PHP PHP 5.4.7 PHP PHP 5.4.8 PHP PHP 5.4.9 PHP PHP 5.4.10 PHP PHP 5.4.11 PHP PHP 5.4.12 PHP PHP 5.4.13 PHP PHP 5.4.14 PHP PHP 5.4.15 PHP PHP 5.4.16 PHP PHP 5.4.17 PHP PHP 5.4.18 PHP PHP 5.4.19 PHP PHP 5.4.20 PHP PHP 5.4.21 PHP PHP 5.4.22 PHP PHP 5.4.23 PHP PHP 5.5.0 PHP PHP 5.5.1 PHP PHP 5.5.2 PHP PHP 5.5.3 PHP PHP 5.5.4 PHP PHP 5.5.5 PHP PHP 5.5.6 PHP PHP 5.5.7	587

D2sec

name	IPS Community Suite RCE
url	http://www.d2sec.com/exploits/ips_community_suite_rce.html

Exploit-Db

description	IPS Community Suite 4.1.12.3 - PHP Code Injection. CVE-2016-6174. Webapps exploit for php platform
file	exploits/php/webapps/40084.txt
id	EDB-ID:40084
last seen	2016-07-11
modified	2016-07-11
platform	php
port	80
published	2016-07-11
reporter	Egidio Romano
source	https://www.exploit-db.com/download/40084/
title	IPS Community Suite 4.1.12.3 - PHP Code Injection
type	webapps

Nessus

NASL family	MacOS X Local Security Checks
NASL id	MACOS_10_12.NASL
description	The remote host is running a version of Mac OS X that is prior to 10.10.5, 10.11.x prior to 10.11.6, or is not macOS 10.12. It is, therefore, affected by multiple vulnerabilities in the following components : - apache - apache_mod_php - Apple HSSPI Support - AppleEFIRuntime - AppleMobileFileIntegrity - AppleUCC - Application Firewall - ATS - Audio - Bluetooth - cd9660 - CFNetwork - CommonCrypto - CoreCrypto - CoreDisplay - curl - Date & Time Pref Pane - DiskArbitration - File Bookmark - FontParser - IDS - Connectivity - ImageIO - Intel Graphics Driver - IOAcceleratorFamily - IOThunderboltFamily - Kerberos v5 PAM module - Kernel - libarchive - libxml2 - libxpc - libxslt - mDNSResponder - NSSecureTextField - Perl - S2 Camera - Security - Terminal - WindowServer Note that successful exploitation of the most serious issues can result in arbitrary code execution.
last seen	2020-06-01
modified	2020-06-02
plugin id	93685
published	2016-09-23
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93685
title	macOS < 10.12 Multiple Vulnerabilities

Packetstorm

data source	https://packetstormsecurity.com/files/download/137804/KIS-2016-11.txt
id	PACKETSTORM:137804
last seen	2016-12-05
published	2016-07-07
reporter	EgiX
source	https://packetstormsecurity.com/files/137804/IPS-Community-Suite-4.1.12.3-PHP-Code-Injection.html
title	IPS Community Suite 4.1.12.3 PHP Code Injection

Seebug

bulletinFamily	exploit
description	Details source: The [know Chong Yu 404 security lab](<http://blog.knownsec.com/2016/08/ips-community-suite-php-rce-cve-2016-6174/>) ### A vulnerability overview 1\. Vulnerability information "IPS Community Suite "is a foreign of the more common cms. But in its 4. 1. 12. 3 version and the following version, there is a PHP code injection vulnerability that stems from the procedures fail to adequately filter content_class request parameters. A remote attacker may exploit this vulnerability to inject and execute arbitrary PHP code. 2\. Vulnerability trigger conditions IPS version:`<=4.1.12.3` php environment:`<=5.4. 24 and 5. 5. 0-5. 5. 8` ### Second, the vulnerability reproduction #### 1\. Vulnerability analysis In /applications/core/modules/front/system/content.php in the file there is a section of this code, `$class = 'IPS' . implode( ", explode( '_', IPSRequest::i()->content_class ) ); if ( ! class_exists( $class ) or ! in_array( 'IPSContent', class_parents( $class ) ) ) { IPSOutput::i()->error( 'node_error', '2S226/2', 404, " ); }` Here program by IPSRequest::i()->content_class get us through the GET request submitted content_class parameters, after a certain string of processing, after entering the class_exists function, in the process, and not on our incoming data is filtered, it is possible to produce vulnerability, the following we go into to /applications/cms/Application.php file spl_autoload_register function `if ( mb_substr( $class, 0, 14 ) === 'IPScmsFields' and is_numeric( mb_substr( $class, 14, 1 ) ) ) { $databaseId = mb_substr( $class, 14 ); eval( "namespace IPScms; class Fields{$databaseId} the extends Fields { public static $customDatabaseId [...] }` Finally, we can construct a specific parameter, enter the eval function, resulting in remote code execution The program process is as follows: ![](http://blog.knownsec.com/wp-content/uploads/2016/08/ips.png) #### 2\. IPS official repair analysis Through our analysis and comparison Found in / applications/cms/Application. php this file in the original spl_autoload_register() and after the update ![](http://blog.knownsec.com/wp-content/uploads/2016/08/ips_fix-1024x413.png) We can see that the official use of the intval() function the last incoming $class to an integer validation So that the incoming $class 14th place after being qualified to become an integer, prevent the incoming string into the eval() #### 3\. PHP version upgrade analysis In PHP version >=5.4.25 or >=5.5.9. changes class_exists mechanism While less than the version without this restriction can normally trigger the vulnerability `$class = 'IPS' . implode( ", explode( '_', IPSRequest::i()->content_class ) ); if ( ! class_exists( $class ) or ! in_array( 'IPSContent', class_parents( $class ) ) ) { IPSOutput::i()->error( 'node_error', '2S226/2', 404, " ); }` Here `$class="IPS\cms\Fields1{}phpinfo();/"` time no longer triggering the class_exists() to load `/applications/cms/Application.php ` the spl_autoload_register (), it will trigger the vulnerability #### 4\. Exploit Thus, we can construct a PoC of: `http:///ips/index. php? app=core&module=system&controller=content&do=find&content_class=cms\Fields1{}phpinfo();/` Effect as shown: ![](http://blog.knownsec.com/wp-content/uploads/2016/08/phpinfo.png) Pocsuite: ![](http://blog.knownsec.com/wp-content/uploads/2016/08/pocsuite-verify.png) #### 5\. Bug fixes PHP 5.4. x upgraded to 5.4.25 more than 5.5. x upgrade to 5.5.9 above IPS to upgrade to`4.12.3.1 above ### Third, the reference http://blog.knownsec.com/2016/08/ips-community-suite-php-rce-cve-2016-6174/ * https://invisionpower.com/ * http://windows.php.net/downloads/releases/archives/ * http://karmainsecurity.com/KIS-2016-11 * http://cve.mitre.org/cgi-bin/cvename.cgi?name=2016-6174
id	SSV:92096
last seen	2017-11-19
modified	2016-07-13
published	2016-07-13
reporter	Root
title	IPS Community Suite <= 4.1.12.3 Autoloaded PHP remote code execution vulnerability

Summary

Vulnerable Configurations

D2sec

Exploit-Db

Nessus

Packetstorm

Seebug

References