Franck Chevalier

An unauthenticated blind SQL injection exists in the SQL escaping layer. This issue allows attackers to inject arbitrary SQL by providing a crafted `annee` parameter value consisting of a word character followed by an open parenthesis, which bypasses escaping for date-type columns in MySQL, SQLite, and PostgreSQL backends. The flaw can be exploited via the `annee` criterion in the `sitemap.xml.html` template to execute time-based or boolean payloads. This can lead to the extraction of arbitrary database content, including the `alea ephemere` secret used to sign action nonces, and can be chained to achieve remote code execution (RCE).

An authorization flaw exists in sensitive actions located under the 'ecrire/action/' endpoint. Unauthenticated attackers can invoke privileged actions by providing a valid CSRF (Cross-Site Request Forgery) nonce—a unique token used to prevent unauthorized requests—without the server performing necessary permission checks. By sending direct HTTP requests, attackers can bypass template-level authorization guards to execute actions such as `editer auteur()`, allowing them to rewrite passwords for any account, including administrators, leading to full account takeover.

A mass assignment issue exists in the `editer objet` action. Unauthenticated attackers can write arbitrary rows to any SQL table that does not have a `champs editables` allowlist by providing a controlled `arg` parameter that resolves to internal database tables. This allows an attacker to insert a malicious row into the `spip jobs` queue containing a specific PHP function and arguments. When the cron process handles the queue, the injected function is dynamically executed, leading to remote code execution.