CVE-2026-72708 in SPIP
Summary
by MITRE • 09/11/2026
SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the public sitemap endpoint where the MySQL escaper spip_mysql_cite() in ecrire/req/mysql.php returns values unescaped when the target column is a date type and the supplied value matches the pattern of a word character followed by an open parenthesis. Attackers can supply a crafted value such as a time-based payload through the annee parameter in squelettes-dist/sitemap.xml.html to embed arbitrary SQL directly into the generated query, enabling time-based and boolean-based blind SQL injection that can expose arbitrary database content including the alea_ephemere secret used to sign action nonces.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified in SPIP versions prior to 4.4.18 represents a critical unauthenticated blind SQL injection flaw located within the public sitemap generation endpoint. This security defect stems from an improper handling of user-supplied input by the database abstraction layer, specifically involving the spip_mysql_cite function defined in ecrire/req/mysql.php. The root cause lies in a logic error where the escaper fails to properly sanitize data when the target column is identified as having a date type and the supplied value matches a specific pattern consisting of a word character followed by an open parenthesis. This edge case allows attackers to bypass standard escaping mechanisms, effectively injecting arbitrary SQL commands directly into the query executed against the MySQL database server.
From a technical perspective, the vulnerability exploits the interaction between PHP string processing and MySQL date parsing routines. When the application constructs a SQL query using user-controlled data via the annee parameter in squelettes-dist/sitemap.xml.html, it relies on spip_mysql_cite to ensure safety. However, due to the specific condition involving word characters followed by parentheses, the function returns values unescaped under certain circumstances. This failure enables two distinct exploitation vectors: time-based blind SQL injection and boolean-based blind SQL injection. In a time-based attack, an adversary can inject payloads that cause deliberate delays in database response times, allowing them to infer information based on latency variations. Alternatively, boolean-based techniques allow attackers to deduce data by observing differences in the application's behavior or HTTP responses when true versus false conditions are evaluated during query execution.
The operational impact of this vulnerability is severe due to its unauthenticated nature and the sensitivity of the data accessible through exploitation. Attackers do not require valid credentials to initiate these attacks, making them easily scalable via automated tools targeting public-facing endpoints. The most significant consequence is the potential exposure of arbitrary database content stored within the SPIP installation. Of particular concern is the ability to extract the alea_ephemere secret, which serves as a cryptographic key for signing action nonces used in CSRF protection mechanisms. Compromise of this secret allows attackers to forge valid session tokens and perform unauthorized actions on behalf of authenticated users, effectively bypassing cross-site request forgery protections and gaining full administrative control over the web application.
This vulnerability aligns with CWE-89, which classifies improper neutralization of special elements used in an SQL command, commonly known as SQL Injection. The exploitation method described corresponds to ATT&CK technique T1059.004, specifically PowerShell or Command and Scripting Interpreter subcategories if leveraging system-level impacts, but more accurately maps to T1190 Exploit Public-Facing Application within the Initial Access tactic. Furthermore, the extraction of sensitive configuration data like nonces relates to CWE-200 Exposure of Sensitive Information to an Unauthorized Actor. The lack of authentication requirement places this in a high-risk category for web applications, as it allows remote code execution at the database level without prior compromise of user accounts.
Mitigation strategies must focus on immediate patching and defensive coding practices. Organizations running SPIP should upgrade to version 4.4.18 or later where this logic error has been corrected in the MySQL escaper function. For environments unable to update immediately, input validation at the application layer is recommended as a temporary countermeasure. Developers should enforce strict type checking for parameters like annee, ensuring that only valid date formats are accepted and rejecting inputs containing special characters such as parentheses before they reach the database abstraction layer. Additionally, implementing Web Application Firewalls with rules specifically tuned to detect SQL injection patterns in URL parameters can provide an additional layer of defense against exploitation attempts targeting this specific endpoint.