CVE-2026-72708: SPIP < 4.4.18 Unauthenticated SQL Injection via sitemap annee Parameter
SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the public sitemap endpoint where the MySQL escaper spipmysqlcite() in ecrire/req/mysql.php returns values unescaped when the target column is a date type and the supplied value matches the pattern of a word character followed by an open parenthesis. Attackers can supply a crafted value such as a time-based payload through the annee parameter in squelettes-dist/sitemap.xml.html to embed arbitrary SQL directly into the generated query, enabling time-based and boolean-based blind SQL injection that can expose arbitrary database content including the aleaephemere secret used to sign action nonces.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SPIPto a version that resolves this vulnerability.Fixed in 4.4.18 - Compensating control
Restrict access to the public sitemap endpoint (squelettes-dist/sitemap.xml.html and associated sitemap functionality) so unauthenticated clients cannot reach it, until SPIP is upgraded to 4.4.18 or later.
Event History
Frequently Asked Questions
Which deployments are exposed?
SPIP installations running versions before 4.4.18 are affected when the public sitemap endpoint is reachable. The vulnerable input is the annee parameter processed by squelettes-dist/sitemap.xml.html.
Does an attacker need an account or user interaction?
No. The issue is exploitable without authentication and does not require user interaction; an attacker can send a crafted annee parameter to the public endpoint.
What could an attacker obtain through this issue?
The blind SQL injection can be used to extract arbitrary database content through time-based or boolean-based techniques. This may include the alea_ephemere secret used to sign action nonces.