CVE-2024-23659

MEDIUM

SPIP < 4.1.14 and 4.2.x < 4.2.8 - Cross-Site Scripting via Uploaded File Name

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-23659. PoCs published by amis13.

AI-analyzed exploit summary This repository contains a functional Python exploit for an unauthenticated Remote Code Execution (RCE) vulnerability in SPIP's BigUp plugin. The exploit leverages a multipart form submission to inject PHP payloads and execute arbitrary commands, returning output via HTTP headers.

Description

SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file. This is related to javascript/bigup.js and javascript/bigup.utils.js.

Exploits (1)

github WORKING POC
by amis13 · pythonpoc
https://github.com/amis13/SPIP-CVE-2024-23659-

This repository contains a functional Python exploit for an unauthenticated Remote Code Execution (RCE) vulnerability in SPIP's BigUp plugin. The exploit leverages a multipart form submission to inject PHP payloads and execute arbitrary commands, returning output via HTTP headers.

Classification
Working Poc 98%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: SPIP (with BigUp plugin), likely versions affected by CVE-2024-8517 (note: repo incorrectly labels it as CVE-2024-23659)
No auth needed
Prerequisites: Target must have SPIP with the BigUp plugin installed and vulnerable · Network access to the target SPIP instance · Python 3.8+ with `requests` and `beautifulsoup4` dependencies
mistral-large-3 · analyzed Jul 28, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v3 6.1
EPSS 0.0044
EPSS Percentile 36.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
spip/spip < 4.1.14
Published Jan 19, 2024
Tracked Since Feb 18, 2026