Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
spip-cve-2023-27372-rce — SPIP CVE-2023-27372 Unauthenticated RCE Exploit (Web Shell Upload) | Kitploit
Tools/GitHubGitHub/1ronkkeli/spip-cve-2023-27372-rce
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRed Teaming
GitHub1ronkkeli/spip-cve-2023-27372-rce

spip-cve-2023-27372-rce

SPIP CVE-2023-27372 Unauthenticated RCE Exploit (Web Shell Upload)

View Repository
21 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

SPIP CVE-2023-27372 Unauthenticated RCE Exploit (Web Shell Upload)

This Python script exploits CVE-2023-27372, an unauthenticated remote code execution vulnerability in SPIP CMS versions prior to 4.2.1. It leverages a cache poisoning flaw in the password reset mechanism to upload a web shell and gather basic system information.

Author: @ronkkeli (Script v1.2) TryHackMe: ronkkeli Original PoC Concept: nuts7

CVE Information

  • CVE ID: CVE-2023-27372
  • CVSS Score: 9.8 (Critical)
  • Affected Versions: SPIP CMS versions < 4.2.1

Vulnerability Description

An unauthenticated RCE vulnerability exists in the ecrire/inc/filtres.php file within the reset_cache function. This function uses the oubli parameter from the password recovery page (spip.php?page=spip_pass). By sending a specially crafted serialized payload in the parameter, an attacker can inject arbitrary PHP code into the cache file . This script uses this flaw to execute and write a persistent web shell to the server.

oubli
ecrire/data/cache/reset_cache.php
file_put_contents

Script Features (v1.2)

  • Fetches the required Anti-CSRF token automatically.
  • Constructs and sends the serialized payload to upload a web shell.
  • Allows customization of the web shell's filename (-f).
  • Allows customization of the web shell's PHP code (-d).
  • Enhanced Post-Exploit Check: Verifies shell upload and attempts to gather basic system info (whoami, hostname, uname, id, pwd) using the shell.
  • Presents gathered information in a clean, aligned format.
  • Provides colorized output for better readability.
  • Includes usage examples for reverse shells.

Requirements

  • Python 3.x
  • requests library
  • beautifulsoup4 library

Installation

root@kitploit:~
pip install requests beautifulsoup4
Download Tool