Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2024-7954 — Unauthenticated remote command execution exploit for SPIP CMS 4.2.8 (CVE-2024-7954) with proxy support and live output retrieval. | Kitploit
Tools/GitHubGitHub/r0otk3r/cve-2024-7954
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & EducationRed Teaming
GitHubr0otk3r/cve-2024-7954

CVE-2024-7954

Unauthenticated remote command execution exploit for SPIP CMS 4.2.8 (CVE-2024-7954) with proxy support and live output retrieval.

View Repository
11 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2024-7954 - SPIP 4.2.8 Remote Command Execution (RCE) Exploit

This script exploits a Remote Code Execution vulnerability in SPIP version 4.2.8 via the porte_plume_previsu endpoint. The vulnerability allows unauthenticated attackers to inject PHP code through preview rendering of crafted image tags.

CVE ID: CVE-2024-7954
Component: SPIP CMS (porte_plume_previsu)
Impact: Unauthenticated Remote Command Execution
Severity: Critical

Exploit Capabilities

  • Execute arbitrary system commands
  • Retrieve live command output
  • Automatically extract and display IP geolocation info
  • Proxy support (Burp/ZAP or other)

Usage

root@kitploit:~
python3 cve_2024_7954_rce.py --url <TARGET_URL> --cmd <COMMAND> [--proxy <IP:PORT>]

Example 1

root@kitploit:~
python3 cve_2024_7954_rce.py --url <TARGET_URL> --cmd "whoami" --proxy "127.0.0.1:8080"

who

Burp Suite Request/Response:

bwho

Example 2

root@kitploit:~
python3 cve_2024_7954_rce.py --url <TARGET_URL> --cmd "id" --proxy "127.0.0.1:8080"

id

Burp Suite Request/Response:

bid

Example 3

root@kitploit:~
python3 cve_2024_7954_rce.py --url <TARGET_URL> --cmd "uname -a" --proxy "127.0.0.1:8080"

uname

Burp Suite Request/Response:

b uname

⚠️ Disclaimer

This exploit script is for authorized security testing, defensive research, and educational purposes only.

Official Channels

  • YouTube @rootctf
  • X @r0otk3r
Download Tool