CVE-2024-30163

The vulnerability is located in the file applications/nexus/modules/front/store/store.php, specifically in the _categoryView() method of the IPS\nexus\modules\front\store\_store class. User data passed via the 'filter' request parameter is not properly sanitized before being used to construct SQL queries. An unauthenticated attacker can send crafted parameter values, thereby executing Blind SQL Injection attacks — gradually reading database contents by analyzing application responses.

An unauthenticated attacker can gain unauthorized access to data stored in the database (including user data, passwords, transaction information), and potentially also modify or delete data, threatening the confidentiality, integrity, and availability of the system.

Invision Community should be updated to version 4.7.16 or newer. Release information is available in the official vendor release notes at: https://invisioncommunity.com/release-notes/4716-r128/

Invision Community (IPS) in all versions before 4.7.16 with the active Nexus store module.