Skip to content

Commit 5e2bf5a

Browse files
committed
fix(modules): spip_bigup_unauth_rce minor fix
1 parent 3b7b704 commit 5e2bf5a

File tree

2 files changed

+4
-3
lines changed

2 files changed

+4
-3
lines changed

documentation/modules/exploit/multi/http/spip_bigup_unauth_rce.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,8 @@ docker run --name casse-spip -p 8000:80 \
5959

6060
## Options
6161

62-
- **FORM_PAGE**: This option allows you to specify a custom page on the target SPIP installation that contains a form.
62+
### FORM_PAGE
63+
This option allows you to specify a custom page on the target SPIP installation that contains a form.
6364
By default, the module will automatically check the `login`, `spip_pass`, and `contact` pages for forms,
6465
but if you know of another page that contains a form, you can specify it here.
6566
For example, if an article page contains a form, you can set this option like so:

modules/exploits/multi/http/spip_bigup_unauth_rce.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ def initialize(info = {})
7777
)
7878
register_options(
7979
[
80-
OptString.new('FORM_PAGE', ['false', 'A page with a form.', 'Auto'])
80+
OptString.new('FORM_PAGE', [true, 'A page with a form.', 'Auto'])
8181
]
8282
)
8383
end
@@ -132,7 +132,7 @@ def get_form_data
132132

133133
next unless res&.code == 200
134134

135-
doc = Nokogiri::HTML(res.body)
135+
doc = res.get_html_document
136136
action = doc.at_xpath("//input[@name='formulaire_action']/@value")&.text
137137
args = doc.at_xpath("//input[@name='formulaire_action_args']/@value")&.text
138138

0 commit comments

Comments
 (0)