OpenStudio

Metasploit · Author

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

Metasploit

SPIP Saisies Plugin Unauthenticated RCE

Metasploit exploitby Valentin Lobstein <chocapikk@leakix.net>Added to Metasploit 2026-02-21ExploitCVE-2025-712431 file

exploit_multi/http/spip_saisies_rce · Ruby

MetasploitPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits payload withheld, an unauthenticated PHP code injection in the SPIP Saisies plugin, by injecting PHP code into the _anciennes_valeurs form parameter to achieve remote code execution.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit exploit for payload withheld. It sends a crafted PHP injection payload to a vulnerable SPIP Saisies plugin form. No backdoor, deceptive payload, or concealed operator-directed harm is present. The code performs only the documented exploit behavior.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesRuby
Target softwareSPIP Saisies plugin
Attack typesRemote Code ExecutionCode Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module's exploit method constructs and sends a malicious HTTP POST request containing PHP code in the _anciennes_valeurs parameter, which is designed to be executed by the target server, achieving remote code execution.

modules/exploits/multi/http/spip_saisies_rce.rb:223-240

Requirements

  • Target must be running SPIP with the Saisies plugin version 5.4.0 through 5.11.0.modules/exploits/multi/http/spip_saisies_rce.rb:34
  • A publicly accessible page containing a saisies-powered form must exist.modules/exploits/multi/http/spip_saisies_rce.rb:28-29

Observed behavior

  • Sends an HTTP POST request with a crafted _anciennes_valeurs parameter containing PHP code to execute arbitrary commands on the server.modules/exploits/multi/http/spip_saisies_rce.rb:231-239
  • Optionally crawls the target SPIP site starting from the sitemap to automatically discover a page with a saisies form.modules/exploits/multi/http/spip_saisies_rce.rb:134-180
  • Performs a version check of the Saisies plugin to determine if the target is vulnerable.modules/exploits/multi/http/spip_saisies_rce.rb:89-104
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThis is the documented exploit mechanism for payload withheld. The payload is base64-encoded and injected into a hidden field rendered with interdire_scripts=false.modules/exploits/multi/http/spip_saisies_rce.rb:228-239
Target Platforms
Payload withheldThe module supports PHP in-memory, Unix/Linux command shell, and Windows command shell targets, consistent with a legitimate RCE exploit.modules/exploits/multi/http/spip_saisies_rce.rb:46-68
Cve Reference
Payload withheldThe module references a known CVE for the SPIP Saisies plugin RCE vulnerability, aligning with the described exploit.modules/exploits/multi/http/spip_saisies_rce.rb:42
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
  • The artifact is not executed, so its operational reliability or safety is not verified.
  • Only the module source and metadata were reviewed; Metasploit framework mixins, libraries, and external payloads are not expanded. The actual payload executed is determined by the user at runtime and is not part of this review.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.