SPIP v4.2.1 - Remote Code Execution (Unauthenticated)

# Exploit Title: SPIP v4.2.1 - Remote Code Execution (Unauthenticated)

# Google Dork: inurl:"/spip.php?page=login"

# Date: 19/06/2023

# Exploit Author: nuts7 (https://github.com/nuts7/CVE-2023-27372)

# Vendor Homepage: https://www.spip.net/

# Software Link: https://files.spip.net/spip/archives/

# Version: < 4.2.1 (Except few fixed versions indicated in the description)

# Tested on: Ubuntu 20.04.3 LTS, SPIP 4.0.0

# CVE reference : CVE-2023-27372 (coiffeur)

# CVSS : 9.8 (Critical)

#

# Vulnerability Description:

#

# SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. Branches 3.2, 4.0, 4.1 and 4.2 are concerned. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.

# This PoC exploits a PHP code injection in SPIP. The vulnerability exists in the `oubli` parameter and allows an unauthenticated user to execute arbitrary commands with web user privileges.

#

# Usage: python3 CVE-2023-27372.py http://example.com