PT-2022-19327 · Spip+2 · Spip+2

Laluka + 1 · Published 2020-11-25 · Updated 2026-04-06 · CVE-2022-28960

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spip versions prior to 3.2.8

Description A PHP injection issue allows attackers to execute arbitrary PHP code via the oups parameter at the "/ecrire" API endpoint.

Recommendations For versions prior to 3.2.8, update to version 3.2.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/ecrire" API endpoint to minimize the risk of exploitation. Avoid using the oups parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2022-28960

DSA-4798-1

USN-7318-1

USN-8150-1

Affected Products

Linuxmint

Spip

Ubuntu

References · 36

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/spip_rce_form.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/spip_bigup_unauth_rce.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/spip_rce_form.rb · Exploit
• 🔥 https://github.com/nuts7/CVE-2023-27372 · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2024-8517 · Exploit
• 🔥 https://github.com/ThatNotEasy/CVE-2023-27372 · Exploit
• 🔥 https://github.com/Pari-Malam/CVE-2023-27372 · Exploit
• 🔥 https://github.com/0SPwn/CVE-2023-27372-PoC · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2023-27372 · Exploit
• 🔥 https://github.com/RSTG0D/CVE-2023-27372-PoC · Exploit
• 🔥 https://thinkloveshare.com/en/hacking/rce_on_spip_and_root_me · Exploit
• https://ubuntu.com/security/CVE-2022-28960 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-28960 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7318-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-23638 · Vendor Advisory