Exploitation Summary
EIP tracks 3 public exploits for CVE-2024-8517.
PoCs published by Chocapikk, saadhassan77, Vozec, Laluka, Julien Voisin, Valentin Lobstein, including Metasploit module exploits/multi/http/spip_bigup_unauth_rce.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2024-8517, an unauthenticated RCE vulnerability in the SPIP BigUp plugin. The exploit leverages improper input validation in the `lister_fichiers_par_champs` function to execute arbitrary PHP code via crafted multipart form data.
Description
SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.
Exploits (3)
This repository contains a functional exploit for CVE-2024-8517, an unauthenticated RCE vulnerability in the SPIP BigUp plugin. The exploit leverages improper input validation in the `lister_fichiers_par_champs` function to execute arbitrary PHP code via crafted multipart form data.
This Python script exploits an unauthenticated RCE vulnerability in the SPIP BigUp plugin (CVE-2024-8517) by abusing the `lister_fichiers_par_champs` function. It uploads a malicious PHP payload via the `bigup_retrouver_fichiers` parameter and executes arbitrary commands without authentication.
This Metasploit module exploits a Remote Code Execution vulnerability in the SPIP BigUp plugin by injecting arbitrary PHP code via improper handling of multipart form data in file uploads. The exploit targets unauthenticated users and leverages the `lister_fichiers_par_champs` function triggered by the `bigup_retrouver_fichiers` parameter.
Nuclei Templates (1)
http.favicon.hash:-1224668706
X-Spip-Cache
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H