CVE-2024-30163

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-06-07 · updated 2026-06-17
Weakness: CWE-89

Description

Invision Community before 4.7.16 allow SQL injection via the applications/nexus/modules/front/store/store.php IPS\nexus\modules\front\store\_store::_categoryView() method, where user input passed through the filter request parameter is not properly sanitized before being used to execute SQL queries. This can be exploited by unauthenticated attackers to carry out Blind SQL Injection attacks.

Affected products

Invisioncommunity: from 4.4.0 before 4.7.16 — fixed in 4.7.16

How to fix

Upgrade to a fixed version: Invisioncommunity 4.7.16. Check the vendor advisory for mitigations.

References

http://seclists.org/fulldisclosure/2024/Apr/20
https://invisioncommunity.com/release-notes/4716-r128/
http://seclists.org/fulldisclosure/2024/Apr/20
https://invisioncommunity.com/release-notes/4716-r128/

Get alerted when CVE-2024-30163 or the next vulnerability affects your stack