SPIP Saisies Plugin Unauthenticated RCE

MetasploitMetasploit exploitExploitRubyexploit_multi/http/spip_saisies_rce

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits CVE-2025-71243, an unauthenticated PHP code injection in the SPIP Saisies plugin, by injecting PHP code into the _anciennes_valeurs form parameter to achieve remote code execution.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit exploit for CVE-2025-71243. It sends a crafted PHP injection payload to a vulnerable SPIP Saisies plugin form. No backdoor, deceptive payload, or concealed operator-directed harm is present. The code performs only the documented exploit behavior.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesRuby
Target softwareSPIP Saisies plugin
Attack typesRemote Code ExecutionCode Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module's exploit method constructs and sends a malicious HTTP POST request containing PHP code in the _anciennes_valeurs parameter, which is designed to be executed by the target server, achieving remote code execution.

modules/exploits/multi/http/spip_saisies_rce.rb:223-240

Requirements

  • Target must be running SPIP with the Saisies plugin version 5.4.0 through 5.11.0.modules/exploits/multi/http/spip_saisies_rce.rb:34
  • A publicly accessible page containing a saisies-powered form must exist.modules/exploits/multi/http/spip_saisies_rce.rb:28-29

Observed behavior

  • Sends an HTTP POST request with a crafted _anciennes_valeurs parameter containing PHP code to execute arbitrary commands on the server.modules/exploits/multi/http/spip_saisies_rce.rb:231-239
  • Optionally crawls the target SPIP site starting from the sitemap to automatically discover a page with a saisies form.modules/exploits/multi/http/spip_saisies_rce.rb:134-180
  • Performs a version check of the Saisies plugin to determine if the target is vulnerable.modules/exploits/multi/http/spip_saisies_rce.rb:89-104
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Sends PHP code injection via _anciennes_valeurs POST parameter to execute attacker-supplied payloadThis is the documented exploit mechanism for CVE-2025-71243. The payload is base64-encoded and injected into a hidden field rendered with interdire_scripts=false.modules/exploits/multi/http/spip_saisies_rce.rb:228-239
Target Platforms
PHP, Unix/Linux, WindowsThe module supports PHP in-memory, Unix/Linux command shell, and Windows command shell targets, consistent with a legitimate RCE exploit.modules/exploits/multi/http/spip_saisies_rce.rb:46-68
Cve Reference
CVE-2025-71243The module references a known CVE for the SPIP Saisies plugin RCE vulnerability, aligning with the described exploit.modules/exploits/multi/http/spip_saisies_rce.rb:42
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
  • The artifact is not executed, so its operational reliability or safety is not verified.
  • Only the module source and metadata were reviewed; Metasploit framework mixins, libraries, and external payloads are not expanded. The actual payload executed is determined by the user at runtime and is not part of this review.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1