PT-2009-5373 · Spip · Spip

Pierre Rousset + 1 · Published 2009-09-01 · Updated 2017-08-17 · CVE-2009-3041

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: SPIP versions 1.9 through 1.9.2h SPIP versions 2.0.x through 2.0.8

Description: The issue is related to improper access control for certain PHP files, specifically "ecrire/exec/install.php" and "ecrire/index.php". This allows remote attackers to perform unauthorized actions, including those related to installation and backups. There have been reports of this issue being exploited in the wild.

Recommendations: For SPIP versions 1.9 through 1.9.2h, update to version 1.9.2i or later. For SPIP versions 2.0.x through 2.0.8, update to a version later than 2.0.8.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-3041

Affected Products

Spip

References · 11

• 🔥 http://securityfocus.com/bid/36008 · Exploit
• 🔥 https://exploit-db.com/exploits/9448 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2009-3041 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-3041 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3041 · Vendor Advisory
• http://spip-contrib.net/SPIP-Security-Alert-new-version · Vendor Advisory
• http://fil.rezo.net/secu-14346-14350+14354.patch · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-3041 · Security Note
• http://secunia.com/advisories/36365 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3041 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52381 · Note