CVE-2023-27372 PoC — SPIP 安全漏洞

Source

https://github.com/ThatNotEasy/CVE-2023-27372

Associated Vulnerability

Title: SPIP 安全漏洞 (CVE-2023-27372)
Description:SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.

Description

Perform With Mass Remote Code Execution In SPIP Version (4.2.1)

Readme

## CVE-2023-27372
- The vulnerability exists in the oubli parameter and allows an unauthenticated user to execute arbitrary commands with web user privileges.
Branches 3.2, 4.0, 4.1 and 4.2 are concerned. Vulnerable versions are below 3.2.18, below 4.0.10, below 4.1.18 and below 4.2.1.
## Screenshot
![Screenshot_4](https://github.com/Pari-Malam/CVE-2023-27372/assets/25004320/06e832ed-daaa-4f3d-9b3c-fb7f9b7375e9)
![Screenshot_5](https://github.com/Pari-Malam/CVE-2023-27372/assets/25004320/50b44919-0d23-4422-bc18-976ea7e8be18)
## Requirements
- Python3.7+
## Supported Os
- Linuxer
- Wingays
## Get start with
```
$ git clone https://github.com/Pari-Malam/CVE-2023-27372
$ cd CVE-2023-27372
$ pip/pip3 install -r requirements.txt
$ python/python3 spip.py
```
## Footprints Notes
- By using this tool, you agree that you are using it for educational purposes only and that you will not use it for any illegal activity. You also agree to bear all risks associated with the use of this tool. I will not be responsible for direct or indirect damage caused by the use of this tool. Don't suyyyyyyyyyyyyyyyyyyyy me!
## Author
- Pari Malam
## Contacts
[![Telegram](https://img.shields.io/badge/-Telegram-blue)](https://telegram.me/SurpriseMTFK)
[![Discord](https://img.shields.io/badge/-Discord-purple)](https://discordapp.com/users/829404192585678858)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →