RCE_CVE-2024-7954

RCECVE-2024-7954 Description: The porteplume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request. CRITICAL Exploit:...

CVE-2024-7954

CVE-2024-7954 This exploit will attempt to execute system commands on SPIP targets CVE-2024-7954. Overview This is a bulk scanning and exploitation tool for CVE-2024-7954: SPIP 4.2.8 allows unauthenticated attackers to launch RCE on SPIP targets. This tool is based on this Security Research. How ...

Spip-Go

Spip - Network Honeypot Sensor Spip is a low-interaction network honeypot sensor for Linux, written in Go. It accepts TCP connections on any port the host redirects to it, plain or TLS, answers just enough to make a client send its next message, and writes each exchange as one JSON record with EC...

CVE-2024-7954-RCE

Description The porteplume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request. Exploit Proof of concept POST...

CVE-2023-27372

CVE-2023-27372 Exploit Exploit for CVE-2023-27372 , an unauthenticated Remote Code Execution vulnerability in the SPIP CMS affecting versions prior to 4.2.1. ⚠️ For educational purposes only. Use exclusively on systems you own or have explicit written permission to test. Unauthorized use is...

CVE-2023-27372

CVE-2023-27372 SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1. This PoC exploits a PHP code injection in SPIP. The vulnerability exists in the oubli parameter and allows...

SPIP-BigUp-Unauthenticated-RCE-Exploit-CVE-2024-8517

SPIP BigUp Unauthenticated RCE Exploit CVE-2024-8517 Description This Python script exploits an unauthenticated Remote Code Execution RCE vulnerability in the BigUp plugin of the SPIP CMS Système de Publication pour l'Internet Partagé. The flaw lies in the listerfichiersparchamps function, which...

spip-cve-2023-27372-rce

SPIP CVE-2023-27372 Unauthenticated RCE Exploit Web Shell Upload This Python script exploits CVE-2023-27372, an unauthenticated remote code execution vulnerability in SPIP CMS versions prior to 4.2.1. It leverages a cache poisoning flaw in the password reset mechanism to upload a web shell and...

CVE-2023-27372-POC

CVE-2023-27372-POC Overview This code is a Python POC Proof of Concept for detecting whether a target website has the CVE-2023-27372 vulnerability. You can run this code by providing a single URL or a text file containing multiple URLs. Affected version: SPIP "; Features Check whether the target...

RCE-CVE-2024-7954

RCE-CVE-2024-7954 Description The porteplume plugin, utilized by SPIP versions prior to 4.30-alpha2 , 4.2.13 , and 4.1.16 , is susceptible to a critical arbitrary code execution RCE vulnerability. This flaw allows a remote, unauthenticated attacker to execute arbitrary PHP code as the SPIP user b...

CVE-2024-7954POC

CVE-2024-7954POC The porteplume plugin used in SPIP versions before 4.30-alpha2, 4.2.13, and 4.1.16 has an arbitrary code execution vulnerability. Remote unauthenticated attackers can execute arbitrary PHP code as SPIP users by sending specially crafted HTTP requests...

SPIP-CVE-2024-23659-

SPIP-CVE-2024-23659- Script en Python 3 para validación/explotación de RCE no autenticado en SPIP BigUp Descripción cve.py automatiza: 1. Descubrimiento de formulario SPIP formulaireaction y formulaireactionargs. 2. Envío de payload multipart para ejecutar comandos en el servidor objetivo. 3...

SPIP Saisies - Remote Code Execution

SPIP Saisies plugin 5.4.0 through 5.11.0 contains a remote code execution caused by an unspecified flaw, letting attackers execute arbitrary code on the server, exploit requires no special conditions. id: CVE-2025-71243 info: name: SPIP Saisies - Remote Code Execution author: omarkurt severity:...

SPIP < 4.4.22 - Unauthenticated RCE

SPIP 4.4.21 contains a remote code execution caused by mishandling of the X-Spip-Filtre HTTP request header in analyseresultatskel, letting unauthenticated remote attackers execute arbitrary code. id: CVE-2026-77806 info: name: SPIP 4.4.22 - Unauthenticated RCE author: 0xAkoko severity: critical...

SPIP <3.1.2 - Cross-Site Scripting

SPIP 3.1.2 and earlier contains a cross-site scripting vulnerability in validerxml.php which allows remote attackers to inject arbitrary web script or HTML via the varurl parameter in a validerxml action. id: CVE-2016-7981 info: name: SPIP 3.1.2 - Cross-Site Scripting author: pikpikcu severity:...

CVE-2023-27372-SPIP-4.2.1-Unauthenticated-RCE-PoC

CVE-2023-27372 — SPIP Unauthenticated remote code execution vulnerability in SPIP before 4.2.1. The oubli parameter in the password reset form is vulnerable to PHP object injection due to mishandled deserialization. A crafted serialized payload is executed server-side as the web user, and the...

SPIPScan

SPIPScan SPIP CMS Scanner for penetration testing purpose written in Python, and released under MIT License. This tool has been designed to perform detection of SPIP installs during penetration testing. Currently, the tool detects the version of the SPIP install and tries to detect if the platfor...

CVE-2023-27372

Research Project: CVE-2023-27372 — SPIP RCE, Lab Environment + Safe PoC 1 Description This repository contains: stand/ — a lab environment vulnerable setup on Docker: SPIP + MariaDB. poc/ — a Python verification tool scanner implementing safe confirmation of the vulnerability Safe PoC without...

Silent_CVE_2019_16394

CVE-2019-16394 A simple POC python script of CVE-2019-16394 Script is adjusted for a french website, you may need to modify it if the website language is different. Install pip install -r requirements.txt Usage usage: cve201916394.py -h -u URL -f FILE -v optional arguments: -h, --help show this...

CVE-2023-27372-PoC

This is a proof of concept CVE-2023-27372 SPIP RCE vulnerability. It's a deserilzation flaw which exploits the dangerous use of ENV tag during the reset password feature spip.php?page=spippass within /ecrire/balise/formulaire.php Specifically this line: 1. Syntax: python3 exploit.py -u...