SPIP Saisies 5.4.0-5.11.0 - Remote Code Execution
Title source: llmExploitation Summary
CVE-2025-71243 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 2 public exploits from researchers including Chocapikk, OpenStudio, including a Metasploit module exploits/multi/http/spip_saisies_rce.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2025-71243, an unauthenticated Remote Code Execution (RCE) vulnerability in the SPIP Saisies plugin. The exploit leverages improper input sanitization in the `_anciennes_valeurs` parameter to inject PHP code into a template rendered with `interdire_scripts=false`.
Description
The 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0 contains a critical Remote Code Execution (RCE) vulnerability. An attacker can exploit this vulnerability to execute arbitrary code on the server. Users should immediately update to version 5.11.1 or later.
Exploits (2)
This repository contains a functional exploit for CVE-2025-71243, an unauthenticated Remote Code Execution (RCE) vulnerability in the SPIP Saisies plugin. The exploit leverages improper input sanitization in the `_anciennes_valeurs` parameter to inject PHP code into a template rendered with `interdire_scripts=false`.
This Metasploit module exploits an unauthenticated PHP code injection vulnerability in the SPIP Saisies plugin (CVE-2025-71243) by injecting malicious PHP code via the '_anciennes_valeurs' form parameter, which is rendered unsanitized in a hidden field with 'interdire_scripts=false'.
Nuclei Templates (1)
http.html:"SPIP"
app="SPIP"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H