Invision Community Remote Code Execution Vulnerability in Theme Editor

A remote code execution vulnerability exists in Invision Community versions 5.0.0 prior to 5.0.7. The issue is located in the theme editor controller, specifically within the customCss method of themeeditor.php. This protected method can be accessed by unauthenticated users, allowing them to inject and execute arbitrary PHP code by sending crafted template strings. The vulnerability arises because the method processes the 'content' parameter with the template engine, enabling code execution.

Impact

Exploitation of this vulnerability allows for arbitrary PHP code execution on the server.

Reproduction

To reproduce this vulnerability, send a request to themeeditor.php as an unauthenticated user, including a crafted 'content' parameter that exploits the customCss method. The injected PHP code will be executed on the server.

Remediation

Users are advised to upgrade to Invision Community version 5.0.7 or later.