CVE-2026-122032: SPIP before 4.4.29 Authenticated SQL Injection via where Parameter
SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing spipsanitizefromrequest() sanitization. Attackers can exploit this request parameter mismatch to extract database contents, including protected articles and bcrypt password hashes of users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/spipto a version that resolves this vulnerability.Fixed in 4.4.29+dfsg-1
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs an authenticated SPIP account with back-office access. The issue is exposed through the /ecrire/?exec=articles endpoint.
What is required to trigger the SQL injection?
The attacker submits different values for the where parameter in the GET query string and POST body. This parameter mismatch bypasses spip_sanitize_from_request() sanitization.
What could an attacker obtain?
An attacker can extract database contents, including protected articles and users' bcrypt password hashes.
Which versions are affected?
SPIP versions before 4.4.29 are affected.