CVE-2016-6174

Vulnerability

The vulnerability resides in the /applications/core/modules/front/system/content.php script of IPS Community Suite (Invision Power Board) versions 4.1.12.3 and prior [2][3]. User input supplied through the content_class request parameter is used to construct a class name without proper sanitization (line 38: $class = 'IPS\\' . implode( '\\', explode( '_', \IPS\Request::i()->content_class ) );). This crafted class name is then passed to the class_exists() function at line 40. The exploit leverages an autoloading function in /applications/cms/Application.php (line 171–174) that performs an eval() on user-controlled data when the class name starts with IPS\cms\Fields and is followed by a numeric value. Successful exploitation requires the application to run on PHP versions before 5.4.24 or 5.5.x before 5.5.8 [2][3][4].

Exploitation

An unauthenticated attacker can trigger the vulnerability by sending a crafted HTTP GET request to a vulnerable IPS Community Suite instance [2][4]. The request must target the index.php with parameters app=core&module=system&controller=content&do=find and a malicious content_class value such as cms\Fields1{}phpinfo();/* [2][3][4]. No prior authentication or special network position is required; the attack can be carried out remotely. The vulnerable code path is reachable immediately upon sending the request, with no user interaction needed [2].

Impact

Successful exploitation allows remote, unauthenticated attackers to inject and execute arbitrary PHP code on the web server [2][3][4]. This grants the attacker full control over the affected application and potentially the underlying server, depending on the PHP and web server configuration. The impact includes complete compromise of confidentiality, integrity, and availability (CIA) of the IPS Community Suite instance and any data it processes [2]. The attacker can execute system commands, read/write sensitive files, and pivot to other internal systems.

Mitigation

IPS Community Suite version 4.1.13 (released on 2016-07-05) fixes the vulnerability [2][3][4]. The vendor released this patched version one day after being notified, addressing the issue by properly sanitizing the content_class parameter [2][4]. All users running versions 4.1.12.3 or earlier must upgrade to 4.1.13 or later. No workarounds are documented in the available references, and this CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog. If upgrading is not immediately possible, applying a web application firewall (WAF) rule to block malicious content_class values may serve as a temporary mitigation.