CVE-2013-4557
SPIP < 3.0.12 - Remote Code Execution via Security Screen Connect Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2013-4557.
PoCs published by Arnaud Pachot, Frederic Cikala, Davy Douhine, Valentin Lobstein, including Metasploit module exploits/multi/http/spip_connect_exec.
AI-analyzed exploit summary This Metasploit module exploits a PHP code injection vulnerability in SPIP via the 'connect' parameter, allowing unauthenticated RCE. It supports multiple platforms and payload types, with version checks for targeted exploitation.
Description
The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers to execute arbitrary PHP via the connect parameter.
Exploits (1)
This Metasploit module exploits a PHP code injection vulnerability in SPIP via the 'connect' parameter, allowing unauthenticated RCE. It supports multiple platforms and payload types, with version checks for targeted exploitation.