CVE-2016-6174: High severity invision community vulnerability

Q: What is the severity of CVE-2016-6174?

CVE-2016-6174 is classified as a critical vulnerability due to the potential for remote code execution.

Q: How do I fix CVE-2016-6174?

To fix CVE-2016-6174, upgrade Invision Power Board to version 4.1.13 or later and ensure PHP is updated to 5.4.24 or 5.5.8 or later.

Q: What are the affected versions for CVE-2016-6174?

CVE-2016-6174 affects Invision Power Board versions prior to 4.1.13 and certain PHP versions before 5.4.24 and between 5.5.0 and 5.5.7.

Q: Can CVE-2016-6174 affect my web application?

Yes, if your web application is using an affected version of Invision Power Board or an outdated PHP version, it is vulnerable to CVE-2016-6174.

Q: What type of attack does CVE-2016-6174 allow?

CVE-2016-6174 allows attackers to execute arbitrary code on the server, which can lead to complete system compromise.

Published Jul 12, 2016

Updated

applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.1.13, when used with PHP before 5.4.24 or 5.5.x before 5.5.8, allows remote attackers to execute arbitrary code via the contentclass parameter.

Affected Software

22 affected components

Invisioncommunity Invision Power Board<=4.1.12.3

PHP PHP<=5.4.23

PHP PHP=5.5.0

PHP PHP=5.5.0-alpha1

PHP PHP=5.5.0-alpha2

PHP PHP=5.5.0-alpha3

PHP PHP=5.5.0-alpha4

PHP PHP=5.5.0-alpha5

PHP PHP=5.5.0-alpha6

PHP PHP=5.5.0-beta1

PHP PHP=5.5.0-beta2

PHP PHP=5.5.0-beta3

PHP PHP=5.5.0-beta4

PHP PHP=5.5.0-rc1

PHP PHP=5.5.0-rc2

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

PHP PHP=5.5.7

Event History

Jul 12, 2016

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-6174?

CVE-2016-6174 is classified as a critical vulnerability due to the potential for remote code execution.

How do I fix CVE-2016-6174?

To fix CVE-2016-6174, upgrade Invision Power Board to version 4.1.13 or later and ensure PHP is updated to 5.4.24 or 5.5.8 or later.

What are the affected versions for CVE-2016-6174?

CVE-2016-6174 affects Invision Power Board versions prior to 4.1.13 and certain PHP versions before 5.4.24 and between 5.5.0 and 5.5.7.

Can CVE-2016-6174 affect my web application?

Yes, if your web application is using an affected version of Invision Power Board or an outdated PHP version, it is vulnerable to CVE-2016-6174.

What type of attack does CVE-2016-6174 allow?