CVE-2024-8517

This repository contains a functional exploit for CVE-2024-8517, an unauthenticated RCE vulnerability in the SPIP BigUp plugin. The exploit leverages improper input validation in the `lister_fichiers_par_champs` function to execute arbitrary PHP code via crafted multipart form data.

This Python script exploits an unauthenticated RCE vulnerability in the SPIP BigUp plugin (CVE-2024-8517) by abusing the `lister_fichiers_par_champs` function. It uploads a malicious PHP payload via the `bigup_retrouver_fichiers` parameter and executes arbitrary commands without authentication.

This Metasploit module exploits a Remote Code Execution vulnerability in the SPIP BigUp plugin by injecting arbitrary PHP code via improper handling of multipart form data in file uploads. The exploit targets unauthenticated users and leverages the `lister_fichiers_par_champs` function triggered by the `bigup_retrouver_fichiers` parameter.