CVE-2021-32924

Name of the Vulnerable Software and Affected Versions Invision Community (aka IPS Community Suite) versions prior to 4.6.0

Description The issue is related to the IPScmsmodulesfrontpages builder::previewBlock method interacting unsafely with the IPS Theme::runProcessFunction method, allowing for eval-based PHP code injection by a moderator. This is due to incorrect code generation management in the IPS Community Suite software. Exploitation of the issue may allow a remote attacker to execute arbitrary PHP code.

Recommendations For versions prior to 4.6.0, update to version 4.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the IPScmsmodulesfrontpages builder::previewBlock method and the IPS Theme::runProcessFunction method to minimize the risk of exploitation.