BID:36008

SPIP Versions Prior to 2.0.9 Information Disclosure Vulnerability

Info

SPIP Versions Prior to 2.0.9 Information Disclosure Vulnerability

Bugtraq ID:	36008
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Aug 10 2009 12:00AM
Updated:	Aug 21 2009 09:54PM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	SPIP SPIP 2.0.7 SPIP SPIP 2.0.2 SPIP SPIP 2.0 RC1 SPIP SPIP 2.0 SPIP SPIP 1.9.Alpha 2 SPIP SPIP 1.9.Alpha 1 SPIP SPIP 1.9.2h SPIP SPIP 1.9.2g SPIP SPIP 1.9.2d

Not Vulnerable:	SPIP SPIP 2.0.9 SPIP SPIP 1.9.2i

Discussion

SPIP Versions Prior to 2.0.9 Information Disclosure Vulnerability

SPIP is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to compromise the application and possibly the underlying webserver.

Versions prior to SPIP 2.0.9 are vulnerable.

Exploit / POC

SPIP Versions Prior to 2.0.9 Information Disclosure Vulnerability

An active exploit of this issue has been detected in the wild.

The following exploit code is available:

/data/vulnerabilities/exploits/36008.py

Solution / Fix

SPIP Versions Prior to 2.0.9 Information Disclosure Vulnerability

Solution:
The vendor has released updates. Please see the references for details.

SPIP SPIP 1.9.Alpha 2