rapid7/metasploit-framework — pull request #2100 by ddouhine (2013-07-11 15:40:03+00:00)
Title: added exploit module for PHP inj in SPIP CMS

At first this module was an aux (https://github.com/rapid7/metasploit-framework/pull/1939).
I've turned it into an exploit like @jvazquez-r7 and @wvu-r7 proposed and i've corrected a few thing like @wchen-r7 asked.
Now I should work on other payloads...

This module exploits a PHP code injection in SPIP, a french CMS.
Of course it is not Wordpress or Drupal but SPIP is used a lot in french speaking countries.
Ref: http://w3techs.com/technologies/overview/content_management/all

The vulnerability exists in the connect parameter and allows an unauthenticated user to execute arbitrary commands with web user privileges. Branchs 2.0/2.1/3 are concerned. Vulnerable versions are < 2.0.21 & < 2.1.16 & < 3.0.3. The module has been tested successfully with SPIP 2.0.11/Apache on Ubuntu and Fedora.

The vulnerability is less than one year old and is still usable on Internet.
Ref: http://www.securityfocus.com/bid/54292