CVE-2024-30163

CRITICAL 9.8CVE-2024-30163 · Published 07/06/2024 · updated 17/06/2026

In short

CVE-2024-30163 is a CRITICAL (CVSS 9.8) vulnerability affecting invisioncommunity (invisioncommunity).
Chance of exploitation in the next 30 days (EPSS): 8.7%, higher than 95.1% of all vulnerabilities.
Fix: update to 4.7.16 or later.

Package	Affected versions	Patched versions
invisioncommunity invisioncommunity	`≥ 4.4.0, < 4.7.16`	`4.7.16`

Description

Invision Community before 4.7.16 allow SQL injection via the applications/nexus/modules/front/store/store.php IPS\nexus\modules\front\store\_store::_categoryView() method, where user input passed through the filter request parameter is not properly sanitized before being used to execute SQL queries. This can be exploited by unauthenticated attackers to carry out Blind SQL Injection attacks.

References

seclists.org/fulldisclosure/2024/Apr/20 · Exploit
invisioncommunity.com/release-notes/4716-r128 · Release Notes

More vulnerabilities in invisioncommunity

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free