PT-2017-9452 · Spip · Spip

Nicolas Chatelain · Publicado 2017-01-18 · Atualizado 2017-05-24 · CVE-2016-7998

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SPIP versions 3.1.2 and earlier

Description The issue allows remote authenticated users to execute arbitrary PHP code. This can be achieved by uploading an HTML file with a crafted INCLUDE or INCLURE tag and then accessing it with a valider xml action.

Recommendations For SPIP versions 3.1.2 and earlier, consider restricting access to the template composer/compiler until a fix is available. As a temporary workaround, avoid using the INCLUDE and INCLURE tags in uploaded HTML files to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-7998

DLA-695-1

Produtos afetados

Spip

Referências · 17

• 🔥 https://exploit-db.com/exploits/40595 · Exploit
• https://osv.dev/vulnerability/CVE-2016-7998 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-7998 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-7998 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/10/08/6 · Correção
• http://openwall.com/lists/oss-security/2016/10/07/5 · Correção
• http://openwall.com/lists/oss-security/2016/10/05/17 · Nota
• https://ubuntu.com/security/CVE-2016-7998 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2016-7998 · Aviso do Fabricante
• https://sysdream.com/news/lab/2016-10-19-spip-3-1-2-template-compiler-composer-php-code-execution-cve-2016-7998 · Nota
• https://core.spip.net/projects/spip/repository/revisions/23189 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/10/12/9 · Nota
• https://core.spip.net/projects/spip/repository/revisions/23186 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2016-7998 · Nota de Segurança
• http://securityfocus.com/bid/93451 · Nota