PT-2017-18608 · Invision Power Services · Invision Power Services Community Suite

Published 2017-05-11 · Updated 2020-06-03 · CVE-2017-8898

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Invision Power Services (IPS) Community Suite versions 4.1.19.2 and earlier

Description The issue concerns stored XSS in the Announcements feature, which can lead to privilege escalation from a moderator to an admin. This is achieved by exploiting the announce content parameter in an "index.php?/modcp/announcements/&action=create" request, related to the "<> Source" option.

Recommendations For versions 4.1.19.2 and earlier, as a temporary workaround, consider restricting access to the Announcements feature, specifically the "<> Source" option, until a fix is available. Avoid using the announce content parameter in the affected request until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-8898

Affected Products

Invision Power Services Community Suite

References · 5

• 🔥 https://twitter.com/sxcurity/status/862284967715381248 · Exploit
• 🔥 https://twitter.com/insecurity/status/862154908895780864 · Exploit
• 🔥 http://zeroday.insecurity.zone/exploits/ipb_owned.txt · Exploit
• https://osv.dev/vulnerability/CVE-2017-8898 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8898 · Security Note