Description
Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that execute the XML validator on a local file via a crafted valider_xml request. NOTE: this issue can be combined with CVE-2016-7998 to execute arbitrary PHP code.
Exploits (1)
References (8)
Core 8
Core References
Various Sources x_refsource_misc
https://sysdream.com/news/lab/2016-10-19-spip-3-1-2-exec-code-cross-site-request-forgery-cve-2016-7980/
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/93451
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/10/12/6
Issue Tracking, Patch, Vendor Advisory x_refsource_confirm
https://core.spip.net/projects/spip/repository/revisions/23203
Mailing List, Patch, Third Party Advisory mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/10/06/6
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/10/05/17
Issue Tracking, Patch, Vendor Advisory x_refsource_confirm
https://core.spip.net/projects/spip/repository/revisions/23202
Issue Tracking, Patch, Vendor Advisory x_refsource_confirm
https://core.spip.net/projects/spip/repository/revisions/23201
Scores
CVSS v3
8.8
EPSS
0.0055
EPSS Percentile
68.2%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-352
Status
published
Products (1)
spip/spip
< 3.1.2
Published
Jan 18, 2017
Tracked Since
Feb 18, 2026