automatic module_metadata_base.json update

Author: msjenkins-r7

db/modules_metadata_base.json

@@ -110355,6 +110355,70 @@
     "session_types": false,
     "needs_cleanup": null
   },
+  "exploit_multi/http/spip_porte_plume_previsu_rce": {
+    "name": "SPIP Unauthenticated RCE via porte_plume Plugin",
+    "fullname": "exploit/multi/http/spip_porte_plume_previsu_rce",
+    "aliases": [
+
+    ],
+    "rank": 600,
+    "disclosure_date": "2024-08-16",
+    "type": "exploit",
+    "author": [
+      "Valentin Lobstein",
+      "Laluka",
+      "Julien Voisin"
+    ],
+    "description": "This module exploits a Remote Code Execution vulnerability in SPIP versions up to and including 4.2.12.\n          The vulnerability occurs in SPIP’s templating system where it incorrectly handles user-supplied input,\n          allowing an attacker to inject and execute arbitrary PHP code. This can be achieved by crafting a\n          payload manipulating the templating data processed by the `echappe_retour()` function, invoking\n          `traitements_previsu_php_modeles_eval()`, which contains an `eval()` call.",
+    "references": [
+      "URL-https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-0-alpha2-SPIP-4-2-13-SPIP-4.html",
+      "URL-https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_1_the_feather"
+    ],
+    "platform": "Linux,PHP,Unix,Windows",
+    "arch": "php, cmd",
+    "rport": 80,
+    "autofilter_ports": [
+      80,
+      8080,
+      443,
+      8000,
+      8888,
+      8880,
+      8008,
+      3000,
+      8443
+    ],
+    "autofilter_services": [
+      "http",
+      "https"
+    ],
+    "targets": [
+      "PHP In-Memory",
+      "Unix/Linux Command Shell",
+      "Windows Command Shell"
+    ],
+    "mod_time": "2024-08-20 19:41:05 +0000",
+    "path": "/modules/exploits/multi/http/spip_porte_plume_previsu_rce.rb",
+    "is_install_path": true,
+    "ref_name": "multi/http/spip_porte_plume_previsu_rce",
+    "check": true,
+    "post_auth": false,
+    "default_credential": false,
+    "notes": {
+      "Stability": [
+        "crash-safe"
+      ],
+      "Reliability": [
+        "repeatable-session"
+      ],
+      "SideEffects": [
+        "ioc-in-logs",
+        "artifacts-on-disk"
+      ]
+    },
+    "session_types": false,
+    "needs_cleanup": null
+  },
   "exploit_multi/http/splunk_mappy_exec": {
     "name": "Splunk Search Remote Code Execution",
     "fullname": "exploit/multi/http/splunk_mappy_exec",