SPIP SQL Injection Vulnerability Leading to Remote Code Execution

A SQL injection vulnerability has been identified in SPIP versions prior to 4.4.10. This vulnerability allows authenticated low-privilege users to execute arbitrary SQL queries by exploiting union-based injection techniques. Furthermore, attackers can combine this SQL injection flaw with PHP tag processing to achieve remote code execution on the server.

Impact

Exploitation of this vulnerability allows for SQL injection, which could be used to manipulate the database, and combined with PHP tag processing, it could lead to remote code execution on the server.

Remediation

Users are advised to update to SPIP version 4.4.10 or later. The update can be performed using the SPIP Loader or by downloading the latest version from the SPIP website.