web3-serializer/cve-2025-47916Proof‑of‑concept description for CVE‑2025‑47916, a Remote Code Execution vulnerability affecting Invision Community 5.0.0–5.0.6 via unsafe template processing in the "customCss()" method.
This repository provides a proof‑of‑concept description for
CVE‑2025‑47916, a Remote Code Execution vulnerability affecting
Invision Community versions 5.0.0 through 5.0.6. The issue stems
from improper handling of user-supplied input within the customCss()
method, allowing unauthenticated attackers to execute crafted template
expressions.
The vulnerability resides in the
IPS\core\modules\front\system\themeeditor::customCss() method inside:
/applications/core/modules/front/system/themeeditor.php
The method can be called without authentication and passes the content
request parameter to . Since the value is
processed through the template engine, specially crafted input may lead
to . This enables remote,
unauthenticated attackers to achieve full code execution within the
Invision Community environment.
Theme::makeProcessFunction()usage: main.py [options] target
positional arguments:
target Target URL
optional arguments:
-p, --proxy PROXY Proxy server to route requests
-c, --command CMD Single command to process (for testing output handling)
-t, --test Perform a non-intrusive vulnerability check
Update to Invision Community 5.0.7 or later, where the issue has been resolved.
Vulnerability discovered by Egidio Romano.