module
SPIP connect Parameter PHP Injection
| Disclosed |
|---|
| Jul 4, 2012 |
Disclosed
Jul 4, 2012
Description
This module exploits a PHP code injection vulnerability in SPIP. The vulnerability exists
in the connect parameter, allowing an unauthenticated user to execute arbitrary commands
with web user privileges. Branches 2.0, 2.1, and 3 are affected. Vulnerable versions are
platforms, and has been successfully tested on SPIP 2.0.11 and SPIP 2.0.20 on Apache running
on Ubuntu, Fedora, and Windows Server.
in the connect parameter, allowing an unauthenticated user to execute arbitrary commands
with web user privileges. Branches 2.0, 2.1, and 3 are affected. Vulnerable versions are
platforms, and has been successfully tested on SPIP 2.0.11 and SPIP 2.0.20 on Apache running
on Ubuntu, Fedora, and Windows Server.
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.