CVE-2024-7954 SPIP porte_plume Plugin Arbitrary PHP Execution
Remote unauthenticated attackers can execute arbitrary PHP code via crafted HTTP requests in the SPIP porte_plume plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-7954?
CVE-2024-7954 is a critical code injection vulnerability in SPIP, published on 23 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.
Which versions are affected by CVE-2024-7954?
How do I fix CVE-2024-7954?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-7954 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-7954 exists.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 9 proofs of concept on GitHub.
Sources
Also known as DEBIAN-CVE-2024-7954, GHSA-42mv-3h37-wfh9, UBUNTU-CVE-2024-7954.