If we look at the frame on the left we can see the following:
With this we can intuit that we are facing a SPIP in version 4.1.5 or earlier. If we look for any vulnerability for version 4.1.5 we can find this:
Looking at the repository we can see that we have two ways to do it, manual or automated with the exploit. We'll do it both ways:
Foothold
If we do fuzzing we can find the spip folder that corresponds to the configuration area where we can find the login:
Manual
We will be able to see that there is a post uploaded by the user think, to access the login we will be able to see at the bottom left a button that says Se connecter:
Following the PoC (Proof of Content) we will have to click on the button where it says mot de passe oublié ? :Following the PoC (Proof of Content) we will have to click on the button where it says mot de passe oublié ? :
Now we will see that it asks us to insert an email, we will put any email and we will intercept the request with burpsuite:
In the PoC we will see that in the last line of the request it changes it to oubli and injects the php command:
Now that we have managed to see the phpinfo we will send us a reverse shell with shell(), what we will do is to create a txt to see if we can create files:
