Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
SPIP-CVE-2024-23659- — SPIP (CVE-2024-23659) script with native python3 dependencies | Kitploit
Tools/GitHubGitHub/amis13/spip-cve-2024-23659-
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPenetration Testing
GitHubamis13/spip-cve-2024-23659-

SPIP-CVE-2024-23659-

SPIP (CVE-2024-23659) script with native python3 dependencies

View Repository
21 month agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

SPIP-CVE-2024-23659-

Python 3 script for validation/exploitation of unauthenticated RCE in SPIP BigUp (based on the current code, operational reference to CVE-2024-8517).

⚠️ Important note: The repository name mentions CVE-2024-23659, but the script (cve.py) and its internal messages refer to CVE-2024-8517.
Review and unify this point to avoid technical confusion.

Description

cve.py automates:

  1. Discovery of the SPIP form (formulaire_action and formulaire_action_args).
  2. Sending a multipart payload to execute commands on the target server.
  3. Reading output via the HTTP X-Command-Output header (base64).
  4. Single command mode or interactive shell.

Requirements

  • Python 3.8+ (recommended)
  • Dependencies:
    • requests
    • beautifulsoup4

Installation:

root@kitploit:~
pip install requests beautifulsoup4

Usage

Help

root@kitploit:~
python3 cve.py -h

Main parameters

  • -u, --url (required): target base URL
    Example: http://web.prod.local
  • -c, --command: runs a single command and exits
  • --proxy: HTTP/HTTPS proxy (e.g., http://127.0.0.1:8080)
  • --timeout: HTTP timeout in seconds (default: 10)
  • -v, --verbose: shows request details

Examples

1) Verify and open interactive shell

root@kitploit:~
python3 cve.py -u http://objetivo.local

2) Run a single command

root@kitploit:~
python3 cve.py -u http://objetivo.local -c "id"

3) Use a proxy (Burp, mitmproxy, etc.)

root@kitploit:~
python3 cve.py -u http://objetivo.local --proxy http://127.0.0.1:8080 -v

4) Adjust timeout

root@kitploit:~
python3 cve.py -u http://objetivo.local --timeout 20

Expected flow

  • If the target appears vulnerable:
    • Something like: Objetivo vulnerable. Usuario web: <usuario> will be shown
  • If not:
    • An error message indicating that it does not appear vulnerable or that exploitation failed.

Quick troubleshooting

  • It does not find SPIP form fields
    • Check target URL and connectivity.
    • Try with -v to see HTTP details.
  • X-Command-Output does not appear
    • The target may not be vulnerable.
    • There may be a WAF, non-standard routes, or applied mitigations.
  • Frequent timeouts
    • Increase --timeout.
    • Check proxy, DNS, and network latency.

Legal disclaimer

This repository and its content are provided exclusively for educational, research, and authorized testing purposes.

The use of this software against systems without explicit authorization is illegal and may constitute a crime.
The author and contributors are not liable for damages, service interruptions, data loss, legal liabilities, or any misuse arising from this tool.

By using this code, you agree that:

  1. You will only run it on your own environments or with express, verifiable permission.
  2. You will comply with the applicable laws and regulations of your jurisdiction.
  3. You assume full responsibility for its use.

If you are not authorized, do not use it.

Download Tool