Remote Code Execution Vulnerability in SPIP Product by SPIP
CVE-2016-7998
8.8HIGH
What is CVE-2016-7998?
The SPIP template composer/compiler in versions 3.1.2 and earlier is susceptible to a security flaw that allows a remote authenticated user to execute arbitrary PHP code. This is achieved through the upload of an HTML file containing specially crafted INCLUDE or INCLURE tags, which can be subsequently accessed via the 'valider_xml' action. As a result, this vulnerability poses a significant risk, enabling potentially harmful code execution on the server.
References
EPSS Score
24% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved