CyberRota Analysis
AI-GeneratedSPIP versions prior to 4.4.18 are vulnerable to a critical remote code execution flaw that allows attackers to manipulate SQL table names through the editer_objet action. By exploiting this vulnerability with a valid nonce, attackers can inject malicious data into the spip_jobs table, leading to arbitrary PHP function execution when the cron job queue is processed. Organizations using SPIP should prioritize patching to mitigate the risk of unauthorized access and potential system compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SPIP before 4.4.18 contains a remote code execution vulnerability in the editer_objet action where the arg parameter resolves SQL table names without enforcing an editable columns allowlist, allowing attackers with a valid nonce to inject attacker-controlled rows into the spip_jobs table. Attackers can supply arg=job/0 with crafted fonction and args values, which are later unserialized and executed when the cron job queue is drained, resulting in arbitrary PHP function execution on the underlying system.