PT-2024-6564 · Spip · Spip+1

Louka Jacques-Chevallier · Published 2024-08-19 · Updated 2025-12-08 · CVE-2024-7954

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.30-alpha2, 4.2.13, and 4.1.16

Description The porte plume plugin used by SPIP is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.

Recommendations For SPIP versions prior to 4.30-alpha2, 4.2.13, and 4.1.16, upgrade to a version that is 4.30-alpha2, 4.2.13, or 4.1.16 or later to mitigate the risk of remote exploitation. As a temporary workaround, consider disabling the porte plume plugin until a patch is available. Restrict access to the SPIP system to minimize the risk of exploitation.

Exploit

Fix

RCE

Improper Access Control

Eval Injection

Weakness Enumeration

CWE-284

CWE-1286

CWE-95

Related Identifiers

BDU:2024-07708

CVE-2024-7954

Affected Products

Spip

Porte Plume

References · 38

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/spip_porte_plume_previsu_rce.rb · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2024-7954 · Exploit
• 🔥 https://github.com/bigb0x/CVE-2024-7954 · Exploit
• 🔥 https://github.com/gh-ost00/CVE-2024-7954-RCE · Exploit
• 🔥 https://github.com/MuhammadWaseem29/RCE-CVE-2024-7954 · Exploit
• 🔥 https://github.com/fa-rrel/CVE-2024-7954-RCE · Exploit
• 🔥 https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_1_the_feather · Exploit
• https://cve.org/CVERecord?id=CVE-2024-7954 · Security Note
• https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-0-alpha2-SPIP-4-2-13-SPIP-4.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07708 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-7954 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-7954 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-7954 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-7954 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7954 · Security Note