VulnSocial

CVE-2026-72708Patch

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matching a word character followed by an open parenthesis, which bypasses escaping for date-type columns across MySQL, SQLite, and PostgreSQL backends. Attackers can exploit the always-present sitemap.xml.html template's annee criterion to embed unescaped time-based or boolean payloads into database queries, enabling extraction of arbitrary database content including the alea_ephemere secret used to sign SPIP action nonces.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-17: 1Patch / Workaround · 2026-09-17: 1Technical Details · 2026-09-17: 109-17
Signal classification1 categories
Patch
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • Ambionics Security@ambionics
    Patch

    🚨 Casse-Spip: pre-auth RCE on SPIP, the CMS behind thousands of French public and media sites. 🔎 Our auditor @WaykoDev found the SQLi with Claude Opus 4.8. ⚡ Chained into RCE: 4 anonymous requests, no account. ✅ Fixed in 4.4.18 (CVE-2026-72708/9/10) https://blog.lexfo.fr/casse-spip-sqli-to-rce.html

    Post summary

    The tweet discloses a pre‑auth RCE via SQLi in SPIP that chains to RCE, notes the issue is fixed in version 4.4.18 (CVE‑2026‑72708/9/10), and provides technical details without mentioning exploits, PoCs, or active attacks.

    21322692.8K
    2.0K followersView on X

Explore more

Back to dashboard