Skip to content

Commit ebba72a

Browse files
msjenkins-r7msjenkins-r7
committed
automatic module_metadata_base.json update
1 parent 9de9b52 commit ebba72a

File tree

1 file changed

+132
-117
lines changed

1 file changed

+132
-117
lines changed

‎db/modules_metadata_base.json

Lines changed: 132 additions & 117 deletions
Original file line numberDiff line numberDiff line change
@@ -110745,6 +110745,71 @@
110745110745
"session_types": false,
110746110746
"needs_cleanup": null
110747110747
},
110748+
"exploit_multi/http/spip_connect_exec": {
110749+
"name": "SPIP connect Parameter PHP Injection",
110750+
"fullname": "exploit/multi/http/spip_connect_exec",
110751+
"aliases": [
110752+
110753+
],
110754+
"rank": 600,
110755+
"disclosure_date": "2012-07-04",
110756+
"type": "exploit",
110757+
"author": [
110758+
"Arnaud Pachot",
110759+
"Frederic Cikala",
110760+
"Davy Douhine",
110761+
"Valentin Lobstein"
110762+
],
110763+
"description": "This module exploits a PHP code injection vulnerability in SPIP. The vulnerability exists\n in the connect parameter, allowing an unauthenticated user to execute arbitrary commands\n with web user privileges. Branches 2.0, 2.1, and 3 are affected. Vulnerable versions are\n < 2.0.21, < 2.1.16, and < 3.0.3. This module is compatible with both Unix/Linux and Windows\n platforms, and has been successfully tested on SPIP 2.0.11 and SPIP 2.0.20 on Apache running\n on Ubuntu, Fedora, and Windows Server.",
110764+
"references": [
110765+
"OSVDB-83543",
110766+
"BID-54292",
110767+
"URL-http://contrib.spip.net/SPIP-3-0-3-2-1-16-et-2-0-21-a-l-etape-303-epate-la"
110768+
],
110769+
"platform": "Linux,PHP,Unix,Windows",
110770+
"arch": "php, cmd",
110771+
"rport": 80,
110772+
"autofilter_ports": [
110773+
80,
110774+
8080,
110775+
443,
110776+
8000,
110777+
8888,
110778+
8880,
110779+
8008,
110780+
3000,
110781+
8443
110782+
],
110783+
"autofilter_services": [
110784+
"http",
110785+
"https"
110786+
],
110787+
"targets": [
110788+
"PHP In-Memory",
110789+
"Unix/Linux Command Shell",
110790+
"Windows Command Shell"
110791+
],
110792+
"mod_time": "2024-09-08 07:01:23 +0000",
110793+
"path": "/modules/exploits/multi/http/spip_connect_exec.rb",
110794+
"is_install_path": true,
110795+
"ref_name": "multi/http/spip_connect_exec",
110796+
"check": true,
110797+
"post_auth": false,
110798+
"default_credential": false,
110799+
"notes": {
110800+
"Stability": [
110801+
"crash-safe"
110802+
],
110803+
"Reliability": [
110804+
"repeatable-session"
110805+
],
110806+
"SideEffects": [
110807+
"ioc-in-logs"
110808+
]
110809+
},
110810+
"session_types": false,
110811+
"needs_cleanup": null
110812+
},
110748110813
"exploit_multi/http/spip_porte_plume_previsu_rce": {
110749110814
"name": "SPIP Unauthenticated RCE via porte_plume Plugin",
110750110815
"fullname": "exploit/multi/http/spip_porte_plume_previsu_rce",
@@ -110761,6 +110826,7 @@
110761110826
],
110762110827
"description": "This module exploits a Remote Code Execution vulnerability in SPIP versions up to and including 4.2.12.\n The vulnerability occurs in SPIP’s templating system where it incorrectly handles user-supplied input,\n allowing an attacker to inject and execute arbitrary PHP code. This can be achieved by crafting a\n payload manipulating the templating data processed by the `echappe_retour()` function, invoking\n `traitements_previsu_php_modeles_eval()`, which contains an `eval()` call.",
110763110828
"references": [
110829+
"CVE-2024-7954",
110764110830
"URL-https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-0-alpha2-SPIP-4-2-13-SPIP-4.html",
110765110831
"URL-https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_1_the_feather"
110766110832
],
@@ -110787,7 +110853,7 @@
110787110853
"Unix/Linux Command Shell",
110788110854
"Windows Command Shell"
110789110855
],
110790-
"mod_time": "2024-08-20 19:41:05 +0000",
110856+
"mod_time": "2024-09-08 07:54:11 +0000",
110791110857
"path": "/modules/exploits/multi/http/spip_porte_plume_previsu_rce.rb",
110792110858
"is_install_path": true,
110793110859
"ref_name": "multi/http/spip_porte_plume_previsu_rce",
@@ -110809,6 +110875,71 @@
110809110875
"session_types": false,
110810110876
"needs_cleanup": null
110811110877
},
110878+
"exploit_multi/http/spip_rce_form": {
110879+
"name": "SPIP form PHP Injection",
110880+
"fullname": "exploit/multi/http/spip_rce_form",
110881+
"aliases": [
110882+
110883+
],
110884+
"rank": 600,
110885+
"disclosure_date": "2023-02-27",
110886+
"type": "exploit",
110887+
"author": [
110888+
"coiffeur",
110889+
"Laluka",
110890+
"Julien Voisin",
110891+
"Valentin Lobstein"
110892+
],
110893+
"description": "This module exploits a PHP code injection in SPIP. The vulnerability exists in the\n oubli parameter and allows an unauthenticated user to execute arbitrary commands\n with web user privileges. Branches 3.2, 4.0, 4.1 and 4.2 are concerned. Vulnerable versions\n are <3.2.18, <4.0.10, <4.1.18 and <4.2.1.",
110894+
"references": [
110895+
"URL-https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-2-1-SPIP-4-1-8-SPIP-4-0-10-et.html",
110896+
"URL-https://therealcoiffeur.com/c11010",
110897+
"CVE-2023-27372"
110898+
],
110899+
"platform": "Linux,PHP,Unix,Windows",
110900+
"arch": "php, cmd",
110901+
"rport": 80,
110902+
"autofilter_ports": [
110903+
80,
110904+
8080,
110905+
443,
110906+
8000,
110907+
8888,
110908+
8880,
110909+
8008,
110910+
3000,
110911+
8443
110912+
],
110913+
"autofilter_services": [
110914+
"http",
110915+
"https"
110916+
],
110917+
"targets": [
110918+
"PHP In-Memory",
110919+
"Unix/Linux Command Shell",
110920+
"Windows Command Shell"
110921+
],
110922+
"mod_time": "2024-09-08 07:01:23 +0000",
110923+
"path": "/modules/exploits/multi/http/spip_rce_form.rb",
110924+
"is_install_path": true,
110925+
"ref_name": "multi/http/spip_rce_form",
110926+
"check": true,
110927+
"post_auth": false,
110928+
"default_credential": false,
110929+
"notes": {
110930+
"Stability": [
110931+
"crash-safe"
110932+
],
110933+
"Reliability": [
110934+
"repeatable-session"
110935+
],
110936+
"SideEffects": [
110937+
"ioc-in-logs"
110938+
]
110939+
},
110940+
"session_types": false,
110941+
"needs_cleanup": null
110942+
},
110812110943
"exploit_multi/http/splunk_mappy_exec": {
110813110944
"name": "Splunk Search Remote Code Execution",
110814110945
"fullname": "exploit/multi/http/splunk_mappy_exec",
@@ -131006,122 +131137,6 @@
131006131137
"session_types": false,
131007131138
"needs_cleanup": null
131008131139
},
131009-
"exploit_unix/webapp/spip_connect_exec": {
131010-
"name": "SPIP connect Parameter PHP Injection",
131011-
"fullname": "exploit/unix/webapp/spip_connect_exec",
131012-
"aliases": [
131013-
131014-
],
131015-
"rank": 600,
131016-
"disclosure_date": "2012-07-04",
131017-
"type": "exploit",
131018-
"author": [
131019-
"Arnaud Pachot",
131020-
"Frederic Cikala",
131021-
"Davy Douhine"
131022-
],
131023-
"description": "This module exploits a PHP code injection in SPIP. The vulnerability exists in the\n connect parameter and allows an unauthenticated user to execute arbitrary commands\n with web user privileges. Branches 2.0, 2.1 and 3 are concerned. Vulnerable versions\n are <2.0.21, <2.1.16 and < 3.0.3, but this module works only against branch 2.0 and\n has been tested successfully with SPIP 2.0.11 and SPIP 2.0.20 with Apache on Ubuntu\n and Fedora linux distributions.",
131024-
"references": [
131025-
"OSVDB-83543",
131026-
"BID-54292",
131027-
"URL-http://contrib.spip.net/SPIP-3-0-3-2-1-16-et-2-0-21-a-l-etape-303-epate-la"
131028-
],
131029-
"platform": "PHP",
131030-
"arch": "php",
131031-
"rport": 80,
131032-
"autofilter_ports": [
131033-
80,
131034-
8080,
131035-
443,
131036-
8000,
131037-
8888,
131038-
8880,
131039-
8008,
131040-
3000,
131041-
8443
131042-
],
131043-
"autofilter_services": [
131044-
"http",
131045-
"https"
131046-
],
131047-
"targets": [
131048-
"Automatic"
131049-
],
131050-
"mod_time": "2024-08-19 16:28:52 +0000",
131051-
"path": "/modules/exploits/unix/webapp/spip_connect_exec.rb",
131052-
"is_install_path": true,
131053-
"ref_name": "unix/webapp/spip_connect_exec",
131054-
"check": true,
131055-
"post_auth": false,
131056-
"default_credential": false,
131057-
"notes": {
131058-
},
131059-
"session_types": false,
131060-
"needs_cleanup": null
131061-
},
131062-
"exploit_unix/webapp/spip_rce_form": {
131063-
"name": "SPIP form PHP Injection",
131064-
"fullname": "exploit/unix/webapp/spip_rce_form",
131065-
"aliases": [
131066-
131067-
],
131068-
"rank": 600,
131069-
"disclosure_date": "2023-02-27",
131070-
"type": "exploit",
131071-
"author": [
131072-
"coiffeur",
131073-
"Laluka",
131074-
"Julien Voisin"
131075-
],
131076-
"description": "This module exploits a PHP code injection in SPIP. The vulnerability exists in the\n oubli parameter and allows an unauthenticated user to execute arbitrary commands\n with web user privileges. Branches 3.2, 4.0, 4.1 and 4.2 are concerned. Vulnerable versions\n are <3.2.18, <4.0.10, <4.1.18 and <4.2.1.",
131077-
"references": [
131078-
"URL-https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-2-1-SPIP-4-1-8-SPIP-4-0-10-et.html",
131079-
"URL-https://therealcoiffeur.com/c11010",
131080-
"CVE-2023-27372"
131081-
],
131082-
"platform": "Linux,PHP,Unix",
131083-
"arch": "php, cmd",
131084-
"rport": 80,
131085-
"autofilter_ports": [
131086-
80,
131087-
8080,
131088-
443,
131089-
8000,
131090-
8888,
131091-
8880,
131092-
8008,
131093-
3000,
131094-
8443
131095-
],
131096-
"autofilter_services": [
131097-
"http",
131098-
"https"
131099-
],
131100-
"targets": [
131101-
"Automatic (PHP In-Memory)",
131102-
"Automatic (Unix In-Memory)"
131103-
],
131104-
"mod_time": "2024-08-19 16:28:52 +0000",
131105-
"path": "/modules/exploits/unix/webapp/spip_rce_form.rb",
131106-
"is_install_path": true,
131107-
"ref_name": "unix/webapp/spip_rce_form",
131108-
"check": true,
131109-
"post_auth": false,
131110-
"default_credential": false,
131111-
"notes": {
131112-
"Stability": [
131113-
"crash-safe"
131114-
],
131115-
"Reliability": [
131116-
"repeatable-session"
131117-
],
131118-
"SideEffects": [
131119-
"ioc-in-logs"
131120-
]
131121-
},
131122-
"session_types": false,
131123-
"needs_cleanup": null
131124-
},
131125131140
"exploit_unix/webapp/squash_yaml_exec": {
131126131141
"name": "Squash YAML Code Execution",
131127131142
"fullname": "exploit/unix/webapp/squash_yaml_exec",

0 commit comments

Comments
 (0)