CyberRota Analysis
AI-GeneratedInvoicePlane versions prior to 1.7.2-rc-1 are vulnerable to arbitrary code execution due to improper handling of PHP templates, allowing an attacker to upload a malicious file that can be executed with web-server privileges. This critical vulnerability poses a significant risk to any organization using InvoicePlane for invoice management, as it could lead to unauthorized access and control over the server. Organizations running affected versions should prioritize upgrading to the patched version to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file placed in the directory is automatically trusted by Mdl_templates and can be selected as public_invoice_template. When a public invoice is rendered, the guest View controller includes the trusted file and executes it with web-server privileges. This issue is fixed in version 1.7.2-rc-1.