PT-2013-5072 · Spip · Spip+1

Salvatore Bonaccorso · Published 2013-11-15 · Updated 2016-12-08 · CVE-2013-4557

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SPIP versions 3.0.x prior to 3.0.12 SPIP Security Screen ( core /securite/ecran securite.php) version prior to 1.1.8

Description The issue allows remote attackers to execute arbitrary PHP code. This is achieved via the connect parameter in the Security Screen component of SPIP.

Recommendations For SPIP versions 3.0.x prior to 3.0.12, update to version 3.0.12 or later. For SPIP Security Screen ( core /securite/ecran securite.php) version prior to 1.1.8, update to version 1.1.8 or later. As a temporary workaround, consider restricting access to the Security Screen component until a patch is applied.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2013-4557

DSA-2794-1

Affected Products

Spip

Spip Security Screen

References · 15

• 🔥 http://zone.spip.org/trac/spip-zone/changeset/75105/_core_/securite/ecran_securite.php · Exploit
• http://secunia.com/advisories/55551 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4557 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4557 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-4557 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-4557 · Security Note
• https://osv.dev/vulnerability/CVE-2013-4557 · Vendor Advisory
• https://debian.org/security/2013/dsa-2794 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-4557 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-4557 · Vendor Advisory
• http://securitytracker.com/id/1029317 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4557 · Note
• http://spip.net/fr_article5648.html · Note
• http://spip.net/fr_article5646.html · Note
• http://openwall.com/lists/oss-security/2013/11/10/4 · Note