SPIP 'rubriques.php' SQL Injection Vulnerability

Bugtraq ID:	33021
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 27 2008 12:00AM
Updated:	Dec 31 2008 06:41PM
Credit:	Julien Cayssol
Vulnerable:	SPIP SPIP 1.8.3 SPIP SPIP 1.8.2 g SPIP SPIP 2.0 RC1 SPIP SPIP 2.0 SPIP SPIP 1.9.Alpha 2 SPIP SPIP 1.9.Alpha 1 SPIP SPIP 1.9.2d SPIP SPIP 1.8.2-f SPIP SPIP 1.8.2-e SPIP SPIP 1.8.2-d
Not Vulnerable:	SPIP SPIP 2.0.2 SPIP SPIP 1.9.2g SPIP SPIP 1.8.3b

SPIP 'rubriques.php' SQL Injection Vulnerability

SPIP is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

SPIP 'rubriques.php' SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

SPIP 'rubriques.php' SQL Injection Vulnerability

Solution:
Vendor updates are available. Contact the vendor for details.

SPIP 'rubriques.php' SQL Injection Vulnerability

References:

• SPIP 1-8-3b / 1.9.2g / 2.0.2 (SPIP)
  
• SPIP Homepage (SPIP)