SPIP 4.4.18 Security Advisory: Fixes RCE, SSRF, SQLi, and Unauthorized Access Vulnerabilities

Vulnerability Overview SPIP version 4.4.18 fixes multiple security vulnerabilities, including: Unauthenticated SQL injection Unauthorized access via the API, leading to SQL injection Remote Code Execution (RCE) via , leading to SQL injection Unauthorized access leading to author account modification, resulting in SQL injection Code injection in the private space SSRF (Server-Side Request Forgery) via remote content retrieval redirection Affected Scope These vulnerabilities affect users of SPIP version 4.4.18, particularly those using the aforementioned APIs and features for data manipulation and management. Remediation Upgrade to SPIP version 4.4.18 to fix the aforementioned security vulnerabilities. Specific remediation measures include: Verify login and password modification permissions in Reject requests containing Apply SQL escaping to the field, ignoring the function Apply correct logic in server-specific SQL calculations within DATA loops Deprecate POST calls on unless explicitly authorized Use scalar menu keys Disable models in forum comment text Validate remote URLs for each syndication Apply the same processing to and tags Add signatures to jobs Add the method Add the method to collectors Add disconnection pipelines for plugin notifications Support the option in Deprecate calls with Use URL extensions from Change 301/302/303 responses via the method Remove from Support EXIF image orientation to correct bugs in certain images Do not create editable objects if is not defined Fix ajax model filters Fix selector display in RTL Pass to when there are no files to extract Improve browser-side image resampling quality Correctly set EXIF orientation for image resampling Use the function from the core Ensure and are numeric Accept only PNG as masks Ensure mediabox displays above elements Fix RSS syndication streams Do not copy both full and slim versions of the plugin Additional Information This release also includes other improvements and bug fixes, such as data updates and EXIF orientation support. The is recommended for updates, with relevant configuration and usage instructions provided. Summary Upgrading to SPIP version 4.4.18 effectively fixes the aforementioned security vulnerabilities, ensuring system security.

Goal Reached Thanks to every supporter — we hit 100%!

SPIP 4.4.18 Security Advisory: Fixes RCE, SSRF, SQLi, and Unauthorized Access Vulnerabilities