CVE-2016-7998
published 2017-01-18CVE-2016-7998: The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading an HTML file with a…
PriorityP267high8.8CVSS 3.0
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
13.65%
96.0th percentile
The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading an HTML file with a crafted (1) INCLUDE or (2) INCLURE tag and then accessing it with a valider_xml action.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | spip | < spip 3.1.3-1 (bullseye) | spip 3.1.3-1 (bullseye) |
| spip | spip | <= 3.1.2 | — |
| spip | spip | >= 0 < 3.1.3-1 | 3.1.3-1 |
| spip | spip | >= 0 < 3.1.3-1 | 3.1.3-1 |
| spip | spip | >= 0 < 3.1.3-1 | 3.1.3-1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor HTTP requests to the `ecrire/` endpoint with `exec=valider_xml` combined with a `var_url` parameter pointing to a local or file:// path and `ext=html`; this is the trigger pattern for CVE-2016-7998 exploitation. ↗
- →Detect uploaded HTML files containing crafted SPIP INCLUDE or INCLURE tags, which are used to inject PHP code into the template compiler pipeline. ↗
- →Alert on `include_once` of attacker-controlled PHP files generated by the SPIP template compiler from user-supplied HTML; the compiled PHP file is included if not considered obsolete. ↗
- →The exploit requires two sequential requests to trigger execution: the first compiles the malicious template, the second includes the compiled PHP. Correlate two requests to `valider_xml` with the same `var_url` value within a short time window. ↗
- →CVE-2016-7998 can be chained with the CSRF in CVE-2016-7980 (ecrire/exec/valider_xml.php) to achieve unauthenticated RCE by tricking an admin; detect cross-origin or forged POST/GET requests to valider_xml. ↗
- ·The vulnerability is fixed in SPIP 3.1.3; detections and mitigations are only relevant for SPIP 3.1.2 and earlier. ↗
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
osv8.8HIGH
vendor_debian8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q539-39f7-xr44: The SPIP template composer/compiler in SPIP 3
ghsa_unreviewed·2022-05-17
CVE-2016-7998 [HIGH] CWE-20 GHSA-q539-39f7-xr44: The SPIP template composer/compiler in SPIP 3
The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading an HTML file with a crafted (1) INCLUDE or (2) INCLURE tag and then accessing it with a valider_xml action.
GHSA
GHSA-7w5f-5r8v-pff6: Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml
ghsa_unreviewed·2022-05-17·CVSS 8.8
CVE-2016-7980 [HIGH] CWE-352 GHSA-7w5f-5r8v-pff6: Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml
Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that execute the XML validator on a local file via a crafted valider_xml request. NOTE: this issue can be combined with CVE-2016-7998 to execute arbitrary PHP code.
OSV
CVE-2016-7998: The SPIP template composer/compiler in SPIP 3
osv·2017-01-18·CVSS 8.8
CVE-2016-7998 [HIGH] CVE-2016-7998: The SPIP template composer/compiler in SPIP 3
The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading an HTML file with a crafted (1) INCLUDE or (2) INCLURE tag and then accessing it with a valider_xml action.
OSV
CVE-2016-7980: Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml
osv·2017-01-18·CVSS 8.8
CVE-2016-7980 [HIGH] CVE-2016-7980: Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml
Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that execute the XML validator on a local file via a crafted valider_xml request. NOTE: this issue can be combined with CVE-2016-7998 to execute arbitrary PHP code.
Debian
CVE-2016-7998: spip - The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote auth...
vendor_debian·2016·CVSS 8.8
CVE-2016-7998 [HIGH] CVE-2016-7998: spip - The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote auth...
The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading an HTML file with a crafted (1) INCLUDE or (2) INCLURE tag and then accessing it with a valider_xml action.
Scope: local
bullseye: resolved (fixed in 3.1.3-1)
forky: resolved (fixed in 3.1.3-1)
sid: resolved (fixed in 3.1.3-1)
trixie: resolved (fixed in 3.1.3-1)
Debian
CVE-2016-7980: spip - Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml.php i...
vendor_debian·2016·CVSS 8.8
CVE-2016-7980 [HIGH] CVE-2016-7980: spip - Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml.php i...
Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that execute the XML validator on a local file via a crafted valider_xml request. NOTE: this issue can be combined with CVE-2016-7998 to execute arbitrary PHP code.
Scope: local
bullseye: resolved (fixed in 3.1.3-1)
forky: resolved (fixed in 3.1.3-1)
sid: resolved (fixed in 3.1.3-1)
trixie: resolved (fixed in 3.1.3-1)
No detection rules found.
Exploit-DB
SPIP 3.1.2 - Cross-Site Request Forgery
exploitdb·2016-10-20·CVSS 8.8
CVE-2016-7980 [HIGH] SPIP 3.1.2 - Cross-Site Request Forgery
SPIP 3.1.2 - Cross-Site Request Forgery
---
## SPIP 3.1.2 Exec Code Cross-Site Request Forgery (CVE-2016-7980)
### Product Description
SPIP is a publishing system for the Internet, which put importance on collaborative working, multilingual environments and ease of use. It is free software, distributed under the GNU/GPL licence.
### Vulnerability Description
The vulnerable request to `valider_xml` (see: *SPIP 3.1.2 Template Compiler/Composer PHP Code Execution - CVE-2016-7998*) is vulnerable to Cross-Site Request Forgery, allowing the execution of the CVE-2016-7998 attack by tricking an administrator to open the malicious link.
**Access Vector**: remote
**Security Risk**: high
**Vulnerability**: CWE-352
**CVSS Base Score**: 8.3 (High)
**CVE-ID**: CVE-2016-7980
### Proof of Conc
Exploit-DB
SPIP 3.1.2 Template Compiler/Composer - PHP Code Execution
exploitdb·2016-10-20·CVSS 8.8
CVE-2016-7998 [HIGH] SPIP 3.1.2 Template Compiler/Composer - PHP Code Execution
SPIP 3.1.2 Template Compiler/Composer - PHP Code Execution
---
## SPIP 3.1.2 Template Compiler/Composer PHP Code Execution (CVE-2016-7998)
### Product Description
SPIP is a publishing system for the Internet, which put importance on collaborative working, multilingual environments and ease of use. It is free software, distributed under the GNU/GPL licence.
### Vulnerability Description
The SPIP template composer/compiler does not correctly handle SPIP "INCLUDE/INCLURE" Tags, allowing PHP code execution by an authenticated user.
This vulnerability can be exploited using the CSRF or the XSS vulnerability also found in this advisory.
**Access Vector**: remote
**Security Risk**: critical
**Vulnerability**: CWE-94
**CVSS Base Score**: 9.1 (Critical)
**CVE-ID**: CVE-2016-7998
### Pro
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2016/10/05/17http://www.openwall.com/lists/oss-security/2016/10/07/5http://www.openwall.com/lists/oss-security/2016/10/08/6http://www.securityfocus.com/bid/93451https://core.spip.net/projects/spip/repository/revisions/23186https://core.spip.net/projects/spip/repository/revisions/23189https://core.spip.net/projects/spip/repository/revisions/23192https://sysdream.com/news/lab/2016-10-19-spip-3-1-2-template-compiler-composer-php-code-execution-cve-2016-7998/http://www.openwall.com/lists/oss-security/2016/10/05/17http://www.openwall.com/lists/oss-security/2016/10/07/5http://www.openwall.com/lists/oss-security/2016/10/08/6http://www.securityfocus.com/bid/93451https://core.spip.net/projects/spip/repository/revisions/23186https://core.spip.net/projects/spip/repository/revisions/23189https://core.spip.net/projects/spip/repository/revisions/23192https://sysdream.com/news/lab/2016-10-19-spip-3-1-2-template-compiler-composer-php-code-execution-cve-2016-7998/
2017-01-18
Published