Unauthenticated Command Injection in SPIP BigUp File Upload

Small standalone repository containing one Python exploit (`cve.py`) and a README. The script is a Python 3 unauthenticated RCE exploit/helper for SPIP BigUp. It first probes likely SPIP pages to scrape the hidden form fields `formulaire_action` and `formulaire_action_args`, then sends a crafted multipart/form-data POST to the supplied base URL. The exploit embeds PHP code inside a multipart field name so that the vulnerable BigUp processing path executes `shell_exec(base64_decode(...))`. Output is exfiltrated in the HTTP response header `X-Command-Output`, which the script decodes and prints. Operationally, it supports vulnerability checking via `whoami`, one-shot command execution with `-c`, and an interactive shell loop. The repository appears genuine and functional, not merely a detector, though there is a naming inconsistency between the repository/README mention of CVE-2024-23659 and the script’s internal reference to CVE-2024-8517.

This repository contains a Python exploit script (exploit.py) targeting CVE-2024-8517, an unauthenticated remote code execution vulnerability in the BigUp plugin of the SPIP CMS. The exploit works by abusing improper input validation in the 'lister_fichiers_par_champs' function, allowing an attacker to upload a malicious PHP payload and execute arbitrary commands on the server without authentication. The script is designed for use in restricted environments (such as air-gapped labs) and does not require any external Python dependencies. It supports both single-target and batch exploitation modes. The exploit uploads a PHP payload via a crafted multipart/form-data POST request and retrieves command output through a custom HTTP header. The repository consists of three files: a license, a README with detailed usage instructions and vulnerability background, and the main exploit script. The exploit provides an interactive shell for the attacker, enabling full command execution on the vulnerable server.

This repository contains a single Metasploit module (modules/exploits/multi/http/spip_bigup_unauth_rce.rb) that exploits CVE-2024-8517, a critical unauthenticated remote code execution vulnerability in the BigUp plugin of the SPIP CMS. The exploit targets SPIP versions 4.0.0 through 4.1.17, 4.2.0 through 4.2.15, and 4.3.0 through 4.3.1, allowing attackers to execute arbitrary PHP code via a crafted multipart/form-data POST request to the /spip.php endpoint. The module automatically checks for vulnerable versions, locates a valid form and CSRF token, and delivers a payload that can provide a reverse shell or command execution. The exploit is weaponized, supporting multiple payload types and platforms (PHP, Unix/Linux, Windows). The code is structured as a standard Metasploit module, with clear separation of version checking, form discovery, and exploitation logic. No authentication is required, and the attack is performed over the network via HTTP requests.

This repository contains a weaponized exploit for CVE-2024-8517, a critical unauthenticated remote code execution (RCE) vulnerability in the BigUp plugin of SPIP (versions 4.0 through 4.3.1, 4.2.15, and 4.1.17). The vulnerability arises from improper validation in the 'lister_fichiers_par_champs' function, allowing attackers to inject and execute arbitrary PHP code via crafted multipart/form-data POST requests to endpoints such as /spip.php or /ecrire/?exec=document_edit. The repository includes both a standalone Python exploit (exploit.py) and a Metasploit module (spip_bigup_unauth_rce.rb). The Python script supports scanning, exploitation, and interactive shell access, while the Metasploit module enables payload delivery (e.g., Meterpreter reverse shell) and integrates with the Metasploit framework for automated exploitation. The exploit does not require authentication and can be used against any exposed vulnerable SPIP instance. The included poc.txt demonstrates the raw HTTP request format for exploitation. The repository is well-structured, with clear documentation, requirements, and both manual and framework-based exploitation options.