Description
SPIP before 4.4.23 has a missing authorization check in the mot_de_passe CVT form handler. The traiter function changes any user's password when given a validly-signed form POST, without verifying the caller is authorized for that id_auteur.
An authenticated user injects a SPIP model tag into a forum message preview. The model <formulaire|mot_de_passe|id_auteur=N> causes the server to render the password form for user N and HMAC-sign the form arguments. The preview replaces <form> tags with <div> but leaves hidden inputs intact, leaking the signed arguments. Submitting them changes the target user's password.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use auxiliary/admin/http/spip/idor_password_resetmsf undefined(idor_password_reset) > show actions ...actions...msf undefined(idor_password_reset) > set ACTION < action-name >msf undefined(idor_password_reset) > show options ...show and set options...msf undefined(idor_password_reset) > runPrioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub