Chocapikk/CVE-2025-71243

GitHubRepository PoCExploit

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python exploit for CVE-2025-71243, an unauthenticated remote code execution vulnerability in the SPIP Saisies plugin. The script injects PHP code via the `_anciennes_valeurs` parameter into a form, leveraging SPIP's template engine to execute arbitrary system commands. It includes check, single-command execution, and interactive shell modes, along with a crawler to discover vulnerable forms.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python exploit script for CVE-2025-71243. The exploit script performs the advertised vulnerability check and command execution against a user-supplied target. No concealed executable behavior, persistence, credential theft, unrelated payload, or operator-directed harm was observed. The script's network activity is limited to the user-specified target URL and optional proxy.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareSPIP Saisies plugin
Attack typesremote code executioncode injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a fully functional Python script that actively exploits CVE-2025-71243 by sending crafted HTTP requests to inject and execute arbitrary PHP code on a remote target, achieving remote code execution. It includes modes for checking vulnerability, executing single commands, and providing an interactive shell.

exploit.py:1-17exploit.py:79-80exploit.py:182-208

Requirements

  • Target must have a publicly accessible page containing a saisies-powered form (e.g., via Formidable plugin).README.md:28
  • Saisies plugin version must be between 5.4.0 and 5.11.0 inclusive.exploit.py:57

Observed behavior

  • Sends a POST request with a crafted `_anciennes_valeurs` parameter containing a PHP code injection payload that breaks out of an HTML attribute and executes arbitrary PHP.exploit.py:79-80exploit.py:184-186
  • Executes shell commands by base64-encoding them and injecting a `system(base64_decode(...))` call, then extracts the command output from the HTTP response.exploit.py:188-193
  • Provides an interactive shell loop that repeatedly prompts for commands and prints the output.exploit.py:195-208
  • Includes a crawler that starts from a sitemap page and follows internal links to automatically discover pages containing saisies forms.exploit.py:145-180
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
User-supplied target URLThe exploit sends HTTP requests only to the target URL provided via the -u argument and to the optional proxy specified via --proxy. No hardcoded external hosts are contacted.exploit.py:60-70exploit.py:211-222
Command Execution
PHP code injection via _anciennes_valeurs parameterThe script constructs a payload that injects PHP code into the target SPIP application. The injected code executes a base64-encoded shell command provided by the user via -c or interactive input. This is the advertised exploit behavior.exploit.py:79-80exploit.py:188-193
Review boundaries

What the analysis did not establish

  • Evidence includes only README.md and exploit.py; two additional files (LICENSE and .gitignore) are omitted but are not material to classification.
  • The artifact's code was not executed; classification is based solely on static analysis of the provided source code.
  • Two files (3766 bytes) were omitted from text analysis and flagged as metadata-only; their content was not inspected.
  • The review is limited to the supplied evidence and does not assess the safety of executing the script against a real target.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

lab/docker-compose.yml

Created Vuln labCVE-2025-71243Compose · images

1 Compose manifest · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that deploys a SPIP CMS instance with a MariaDB database and automatically installs a vulnerable version of the Saisies plugin, creating a public contact form to demonstrate CVE-2025-71243.

lab/docker-compose.yml:1-43lab/setup.sh:1-65

Lab assessment

Vulnerability lab

The README explicitly describes CVE-2025-71243 as a remote code execution vulnerability in the SPIP Saisies plugin and provides a PoC. The Docker Compose file and setup script construct a target environment with the vulnerable plugin version 5.10.0 and a public contact form, matching the vulnerability prerequisites.

README.md:1-107lab/docker-compose.yml:1-43lab/setup.sh:1-65
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

spip

vulnerable targetweb application

Runs the SPIP CMS with the Saisies plugin v5.10.0 installed via setup.sh. Exposes port 8889 on the host, mapping to container port 80. The entrypoint runs setup.sh in the background to install the plugin and create a contact form, then starts Apache. Environment variables configure auto-installation and admin credentials.

lab/docker-compose.yml:2-27lab/setup.sh:1-65

db

database

MariaDB 10.11 database service for SPIP. Configured with a healthcheck and environment variables for the SPIP database and user.

lab/docker-compose.yml:29-43

setup.sh

vulnerability lab setup script

A shell script bind-mounted into the spip container. It waits for SPIP installation, downloads and installs the Saisies plugin v5.10.0 from a remote URL, activates it, and creates a public contact form with saisies fields. It also cleans the cache and outputs a ready message.

lab/setup.sh:1-65
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-71243

Supported by supplied evidence

The README describes CVE-2025-71243 as an unauthenticated RCE in the Saisies plugin, and the lab environment installs the vulnerable version 5.10.0 and creates a saisies-powered contact form, matching the described prerequisites and exploitation path.

README.md:1-107lab/setup.sh:7-8lab/setup.sh:13-18lab/setup.sh:22-65
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • A publicly accessible form powered by the Saisies plugin, which the lab creates via setup.sh.README.md:27-29lab/setup.sh:22-65
  • The Saisies plugin version between 5.4.0 and 5.11.0; the lab installs 5.10.0.README.md:11lab/setup.sh:7-8

Evidence-described exercise path

  1. Start the lab environment with docker compose up, which builds and runs the spip and db services.lab/docker-compose.yml:1-43
  2. Wait for the spip container to become healthy and the setup script to finish installing the plugin and creating the contact form.lab/docker-compose.yml:22-27lab/setup.sh:1-65
  3. Send a POST request to the contact form with a crafted _anciennes_valeurs parameter containing a PHP payload to achieve RCE.README.md:55-63
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own target container. The setup script downloads a plugin from a public SPIP repository and creates a form inside the container. The exploit path targets the lab's SPIP instance. No evidence of host escape, external exfiltration, persistence, credential theft, or destructive behavior beyond the intended vulnerability demonstration.

lab/docker-compose.yml:1-43lab/setup.sh:1-65README.md:55-63
Review boundaries

What the analysis did not establish

  • The exploit script (exploit.py) referenced in the README is not included in the evidence packet, so its behavior cannot be assessed.
  • The Docker Compose file uses a bind mount for setup.sh, which is a legitimate lab requirement but could be misused in other contexts; no misuse is visible here.
  • The lab relies on downloading a remote zip file during setup, which introduces a supply-chain dependency not inspected in this packet.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1