PT-2017-9452 · Spip · Spip

Nicolas Chatelain · Published 2017-01-18 · Updated 2017-05-24 · CVE-2016-7998

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SPIP versions 3.1.2 and earlier

Description The issue allows remote authenticated users to execute arbitrary PHP code. This can be achieved by uploading an HTML file with a crafted INCLUDE or INCLURE tag and then accessing it with a valider xml action.

Recommendations For SPIP versions 3.1.2 and earlier, consider restricting access to the template composer/compiler until a fix is available. As a temporary workaround, avoid using the INCLUDE and INCLURE tags in uploaded HTML files to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-7998

DLA-695-1

Affected Products

Spip

References · 17

• 🔥 https://exploit-db.com/exploits/40595 · Exploit
• https://osv.dev/vulnerability/CVE-2016-7998 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7998 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-7998 · Vendor Advisory
• http://openwall.com/lists/oss-security/2016/10/08/6 · Patch
• http://openwall.com/lists/oss-security/2016/10/07/5 · Patch
• https://ubuntu.com/security/CVE-2016-7998 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-7998 · Vendor Advisory
• https://core.spip.net/projects/spip/repository/revisions/23189 · Vendor Advisory
• https://core.spip.net/projects/spip/repository/revisions/23186 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-7998 · Security Note
• https://core.spip.net/projects/spip/repository/revisions/23192 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-7998 · Vendor Advisory
• http://openwall.com/lists/oss-security/2016/10/05/17 · Note
• https://sysdream.com/news/lab/2016-10-19-spip-3-1-2-template-compiler-composer-php-code-execution-cve-2016-7998 · Note