what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

SPIP 4.2.12 Remote Code Execution

Posted Aug 22, 2024

Authored by Valentin Lobstein, Laluka, Julien Voisin | Site metasploit.com

This Metasploit module exploits a remote code execution vulnerability in SPIP versions up to and including 4.2.12. The vulnerability occurs in SPIP's templating system where it incorrectly handles user-supplied input, allowing an attacker to inject and execute arbitrary PHP code. This can be achieved by crafting a payload manipulating the templating data processed by the echappe_retour() function, invoking traitements_previsu_php_modeles_eval(), which contains an eval() call.

tags | exploit, remote, arbitrary, php, code execution

SHA-256 | 220b4c7418ac511ddb8ab8d9f4dfe87f0368c9ca91b9699fa9d3b9a0c425f434

Download | Favorite | View

Related Files

No related files