SPIP Stored Cross-Site Scripting Vulnerability in Syndicated Sites

A stored cross-site scripting vulnerability has been identified in SPIP versions prior to 4.4.9. This issue arises in the private area through syndicated sites, where the #URL_SYNDIC output is inadequately sanitized. An attacker can exploit this by injecting malicious scripts into the syndication URL, which then execute when other administrators view the syndicated site details.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected page.

Remediation

Users can update to SPIP version 4.4.9, which addresses this vulnerability. The update can be performed using the SPIP loader or by downloading the latest version from the SPIP website.