Description

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the public sitemap endpoint where the MySQL escaper spip_mysql_cite() in ecrire/req/mysql.php returns values unescaped when the target column is a date type and the supplied value matches the pattern of a word character followed by an open parenthesis. Attackers can supply a crafted value such as a time-based payload through the annee parameter in squelettes-dist/sitemap.xml.html to embed arbitrary SQL directly into the generated query, enabling time-based and boolean-based blind SQL injection that can expose arbitrary database content including the alea_ephemere secret used to sign action nonces.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-11T17:18:57.197Z",
  "pubdate": "2026-09-11T17:18:57.197Z",
  "executiveSummary": "SPIP versions prior to 4.4.18 contain a critical blind SQL injection vulnerability within the public sitemap endpoint. This vulnerability stems from an improper implementation of the MySQL input sanitization function, specifically concerning date-type database columns. An unauthenticated attacker can exploit this flaw to execute arbitrary SQL queries against the backend database.\nThe vulnerability allows for time-based and boolean-based blind injection attacks. By injecting malicious payloads into the 'annee' parameter of 'squelettes-dist/sitemap.xml.html', an attacker can extract sensitive data from the database. A primary risk factor is the potential exposure of the 'alea_ephemere' secret, a critical value used for signing action nonces within the SPIP framework. Successful exploitation enables unauthorized data exfiltration and undermines the integrity of the application's security tokens, potentially facilitating further unauthorized actions or system compromise. Given that the endpoint is public and does not require authentication, the attack surface is significant, necessitating immediate patching.",
  "technicalDetails": "The vulnerability originates in the 'spip_mysql_cite()' function located in 'ecrire/req/mysql.php'. This function is intended to act as a wrapper for sanitizing inputs before they are included in SQL queries. However, it fails to properly escape input values when the target column is defined as a date type. Specifically, if a supplied value adheres to a pattern consisting of a word character followed by an opening parenthesis, the escaping logic is bypassed.\nThe attack vector involves the public sitemap functionality, specifically the 'squelettes-dist/sitemap.xml.html' template. An attacker can supply a crafted input to the 'annee' parameter. Because the application processes this input without adequate sanitization, the injected content is directly concatenated into the SQL statement executed by the database. The exploitation method relies on the behavior of the database under modified query logic. By injecting time-based payloads (e.g., using sleep functions) or boolean-based conditions, the attacker can observe response times or application behavior to infer database contents bit by bit.\nThe attack flow follows a sequential process: First, the attacker identifies the public URL path for the sitemap. Second, they craft a malicious payload targeting the 'annee' parameter, ensuring the payload fits the 'word character + (' pattern to bypass the faulty 'spip_mysql_cite()' logic. Third, the attacker submits an HTTP GET request containing the payload. The SPIP backend processes the request and executes the resulting malformed SQL query against the database. Finally, the attacker analyzes the server's timing or content response to confirm the injection and proceed with the iterative extraction of database records.\nThe impact of this vulnerability is severe. Beyond general data exfiltration, the capability to retrieve the 'alea_ephemere' secret is particularly dangerous. This secret is integral to SPIP’s security architecture, as it is used to generate nonces for various administrative actions. Compromising this secret allows an attacker to forge valid nonces, bypassing security controls that prevent Cross-Site Request Forgery (CSRF) and other authorization-based vulnerabilities. The lack of authentication requirements makes this vulnerability highly accessible, as it requires no prior access or credentials to execute the initial exploitation phase. Systems utilizing SPIP versions prior to 4.4.18 are fully exposed to this threat unless the underlying sanitization logic is corrected or the endpoint is otherwise shielded from untrusted input."
}