by Kastro
Paper/Archive/CVE-2024-7954

CVE-2024-7954

SPIP SPIP — SPIP porte_plume Plugin Arbitrary PHP Execution

EPSS 90%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.8.998 × 2020.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.

Affected

ProductAffectedFixed inSource
SPIP4.3.0-alpha – < 4.3.0-alpha24.3.0-alpha2CNA
SPIP4.2.0 – < 4.2.134.2.13CNA
SPIP4.1.0 – < 4.1.164.1.16CNA
spip4.3.0-alpha – < 4.3.0-alpha24.3.0-alpha2CISA-ADP
spip4.2.0 – < 4.2.134.2.13CISA-ADP
spip4.1.0 – < 4.1.164.1.16CISA-ADP

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupvulncheck.com/advisories/spip-porte-plumeadvisoryblog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-0-alpha2-SPIP-4-2-13-SPIP-4.htmlexploitthinkloveshare.com/hacking/spip_preauth_rce_2024_part_1_the_feather