{"uuid": "2e2c3f4b-acf1-4dfa-931c-d6bfc9fbbc54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-27372", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/spip_rce_form.rb", "content": "{\"aliases\": [], \"arch\": \"php, cmd\", \"author\": [\"coiffeur\", \"Laluka\", \"Julien Voisin\", \"Valentin Lobstein\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a PHP code injection in SPIP. The vulnerability exists in the\\n          oubli parameter and allows an unauthenticated user to execute arbitrary commands\\n          with web user privileges. Branches 3.2, 4.0, 4.1 and 4.2 are concerned. Vulnerable versions\\n          are <3.2.18, <4.0.10, <4.1.18 and <4.2.1.\", \"disclosure_date\": \"2023-02-27\", \"fullname\": \"exploit/multi/http/spip_rce_form\", \"is_install_path\": true, \"mod_time\": \"2026-04-02 17:30:43 +0000\", \"name\": \"SPIP form PHP Injection\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/spip_rce_form.rb\", \"platform\": \"Linux,PHP,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/spip_rce_form\", \"references\": [\"URL-https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-2-1-SPIP-4-1-8-SPIP-4-0-10-et.html\", \"URL-https://therealcoiffeur.com/c11010\", \"CVE-2023-27372\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"PHP In-Memory\", \"Unix/Linux Command Shell\", \"Windows Command Shell\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:13.127848Z"}