Description

SPIP before 4.4.18 contains a remote code execution vulnerability in the editer_objet action where the arg parameter resolves SQL table names without enforcing an editable columns allowlist, allowing attackers with a valid nonce to inject attacker-controlled rows into the spip_jobs table. Attackers can supply arg=job/0 with crafted fonction and args values, which are later unserialized and executed when the cron job queue is drained, resulting in arbitrary PHP function execution on the underlying system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T17:18:58.907Z",
  "pubdate": "2026-09-11T17:18:58.907Z",
  "executiveSummary": "SPIP versions prior to 4.4.18 are susceptible to a critical Remote Code Execution (RCE) vulnerability stemming from improper input validation within the editer_objet action.\nThe vulnerability enables authenticated attackers—or those possessing a valid nonce—to perform unauthorized SQL injections into the spip_jobs table by manipulating the arg parameter.\nBy injecting malicious payloads into the background job queue, an attacker can achieve arbitrary PHP code execution when the SPIP cron process processes these jobs.\nThe core issue lies in the lack of an allowlist for editable columns when resolving SQL table names, allowing the injection of arbitrary serialized data.\nThis vulnerability poses a severe risk to system integrity and confidentiality, potentially allowing a full system compromise. Successful exploitation requires a valid nonce, which may be obtainable through other means or via low-privileged user interactions. Users are urged to upgrade to version 4.4.18 or later immediately to mitigate this threat.",
  "technicalDetails": "The vulnerability resides in the editer_objet action, which is responsible for managing object modifications within the SPIP framework. The flaw occurs because the application fails to adequately validate or restrict the arg parameter when resolving database table names. Specifically, the function permits operations on sensitive system tables, such as spip_jobs, without enforcing a restrictive allowlist of editable columns.\nThe attack vector involves a crafted request to the editer_objet action using the argument format arg=job/0. By manipulating this parameter, an attacker can influence the database interaction logic to perform unauthorized insertions into the spip_jobs table. The attacker provides specifically crafted fonction and args values, which are stored as serialized data within the database row.\nIn the SPIP architecture, the spip_jobs table acts as a queue for deferred background tasks. The system periodically triggers a cron process that retrieves these rows, unserializes the stored fonction and args, and executes the specified PHP functions. Because the application does not validate the content of these fields before storage or execution, the attacker can supply malicious serialized payloads that reference arbitrary internal or system-level functions.\nThe exploitation flow proceeds as follows: First, the attacker obtains a valid nonce associated with the SPIP session or action. Second, the attacker sends a POST or GET request to the editer_objet action, setting the arg parameter to target the spip_jobs table. Third, the attacker injects the payload via the permitted parameters. Fourth, the SPIP cron handler processes the injected row, unserializing the malicious data and triggering the arbitrary code execution. This allows the attacker to execute PHP code with the privileges of the web server process.\nThis vulnerability is particularly dangerous because it bridges a database manipulation flaw with the application's task execution engine, creating a persistent and asynchronous execution path. Since it affects the underlying PHP execution environment, post-exploitation impact includes full system takeover, unauthorized access to sensitive application data, and the potential to move laterally within the hosting environment."
}