CVE-2016-3154: Code Injection

Published Apr 8, 2016

Updated

The encodercontexteajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object.

Affected Software

62 affected components

Spip SPIP=2.0.0

Spip SPIP=2.0.1

Spip SPIP=2.0.2

Spip SPIP=2.0.3

Spip SPIP=2.0.4

Spip SPIP=2.0.5

Spip SPIP=2.0.6

Spip SPIP=2.0.7

Spip SPIP=2.0.8

Spip SPIP=2.0.9

Spip SPIP=2.0.10

Spip SPIP=2.0.11

Spip SPIP=2.0.12

Spip SPIP=2.0.13

Spip SPIP=2.0.14

Spip SPIP=2.0.15

Spip SPIP=2.0.16

Spip SPIP=2.0.17

Spip SPIP=2.0.18

Spip SPIP=2.0.19

Spip SPIP=2.0.20

Spip SPIP=2.0.21

Spip SPIP=2.0.22

Spip SPIP=2.1.1

Spip SPIP=2.1.2

Spip SPIP=2.1.3

Spip SPIP=2.1.4

Spip SPIP=2.1.5

Spip SPIP=2.1.6

Spip SPIP=2.1.7

Spip SPIP=2.1.8

Spip SPIP=2.1.9

Spip SPIP=2.1.10

Spip SPIP=2.1.11

Spip SPIP=2.1.12

Spip SPIP=2.1.13

Spip SPIP=2.1.14

Spip SPIP=2.1.15

Spip SPIP=2.1.16

Spip SPIP=2.1.17

Spip SPIP=2.1.18

Spip SPIP=2.1.19

Spip SPIP=3.0.0

Spip SPIP=3.0.1

Spip SPIP=3.0.2

Spip SPIP=3.0.3

Spip SPIP=3.0.4

Spip SPIP=3.0.5

Spip SPIP=3.0.6

Spip SPIP=3.0.7

Spip SPIP=3.0.8

Spip SPIP=3.0.9

Spip SPIP=3.0.10

Spip SPIP=3.0.11

Spip SPIP=3.0.13

Spip SPIP=3.0.14

Spip SPIP=3.0.15

Spip SPIP=3.0.16

Spip SPIP=3.0.17

Spip SPIP=3.0.19

Spip SPIP=3.0.20

Spip SPIP=3.1.0

Remediation

Patch Available

https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-1-1-SPIP-3-0-22-et-SPIP-2-1.html?lang=fr

Event History

Apr 8, 2016

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-3154?

CVE-2016-3154 has a high severity rating as it allows remote attackers to execute arbitrary PHP code.

How do I fix CVE-2016-3154?

To fix CVE-2016-3154, upgrade your SPIP installation to version 2.1.19, 3.0.22, or 3.1.1 or later.

Which versions of SPIP are affected by CVE-2016-3154?

CVE-2016-3154 affects SPIP 2.x versions before 2.1.19, 3.0.x versions before 3.0.22, and 3.1.x versions before 3.1.1.

What are PHP object injection attacks in the context of CVE-2016-3154?

PHP object injection attacks allow attackers to inject malicious serialized objects into application code, which can lead to arbitrary code execution.

Is there any recommendation after resolving CVE-2016-3154?

It is recommended to regularly update your SPIP version and monitor for any new vulnerabilities similar to CVE-2016-3154.