CVE-2021-3025: SQL Injection
Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the Downloads REST API (the sortDir parameter in a sortBy=popular action to the GETindex() method in applications/downloads/api/files.php).
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-3025?
CVE-2021-3025 is a vulnerability in Invision Community IPS Community Suite before 4.5.4.2 that allows SQL Injection via the Downloads REST API.
How does the vulnerability in Invision Community IPS Community Suite before 4.5.4.2 occur?
The vulnerability occurs due to improper handling of the sortDir parameter in a sortBy=popular action to the GETindex() method in applications/downloads/api/files.php.
What is the severity of CVE-2021-3025?
The severity of CVE-2021-3025 is high, with a CVSS score of 8.8.
Is there a fix available for CVE-2021-3025?
Yes, a fix is available for CVE-2021-3025 by updating to Invision Community IPS Community Suite version 4.5.4.2 or later.
Are there any additional references for CVE-2021-3025?
Additional references for CVE-2021-3025 can be found at http://packetstormsecurity.com/files/160830/IPS-Community-Suite-4.5.4-SQL-Injection.html and https://invisioncommunity.com/release-notes/.