SPIP Autosave Session Unauthenticated Remote Code Execution

This Metasploit module exploits an unauthenticated RCE in SPIP less than or equal to 4.4.21 via the forum autosave session handler. The action=session endpoint allows any visitor to store arbitrary data in a PHP session variable. By writing PHP code into an autosaveforum session key, the code is...