PT-2023-19502 · Spip+2 · Spip+2

Abyss Watcher · Publicado 2023-01-24 · Atualizado 2025-03-04 · CVE-2023-24258

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SPIP versions 4.1.5 and earlier

Description The issue allows attackers to execute arbitrary code via a crafted POST request, exploiting a SQL injection vulnerability through the oups parameter.

Recommendations For SPIP versions 4.1.5 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-24258

DLA-3347-1

DSA-5325-1

USN-7318-1

Produtos afetados

Linuxmint

Spip

Ubuntu

Referências · 34

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/spip_rce_form.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/spip_rce_form.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/spip_bigup_unauth_rce.rb · Exploit
• 🔥 https://github.com/nuts7/CVE-2023-27372 · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2024-8517 · Exploit
• 🔥 https://github.com/ThatNotEasy/CVE-2023-27372 · Exploit
• 🔥 https://github.com/Pari-Malam/CVE-2023-27372 · Exploit
• 🔥 https://github.com/RSTG0D/CVE-2023-27372-PoC · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2023-27372 · Exploit
• 🔥 https://github.com/0SPwn/CVE-2023-27372-PoC · Exploit
• 🔥 https://github.com/Abyss-W4tcher/ab4yss-wr4iteups/blob/ffa980faa9e3598d49d6fb7def4f7a67cfb5f427/SPIP%20-%20Pentest/SPIP%204.1.5/SPIP_4.1.5_AND_BEFORE_AUTH_SQLi_Abyss_Watcher.md · Exploit
• https://ubuntu.com/security/notices/USN-7318-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-24258 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2023-24258 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2022-28960 · Aviso do Fabricante