Spip Crayons Plugin
Monthly
Unauthenticated remote code execution in the SPIP Crayons plugin before 3.5.0 allows any remote attacker to take over a SPIP site by reaching crayons_store.php without the secu_ anti-forgery parameter, which causes the authorization dispatcher to select an unconditionally-true handler instead of the legitimate modification check. With authorization bypassed, the attacker can write an arbitrary .html skeleton file, read configuration files that expose the site secret, and forge a signed AJAX context that executes the planted skeleton as PHP under the web-server user. The assessed impact is high across confidentiality, integrity, and availability (CVSS:3.1 AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H; vendor-scored 9.3), exploitation requires only that the Crayons plugin be installed and enabled below 3.5.0, and no public exploit code was identified at time of analysis though the flaw is trivially reachable and unauthenticated.
Unauthenticated remote code execution in the SPIP Crayons plugin before 3.5.0 allows any remote attacker to take over a SPIP site by reaching crayons_store.php without the secu_ anti-forgery parameter, which causes the authorization dispatcher to select an unconditionally-true handler instead of the legitimate modification check. With authorization bypassed, the attacker can write an arbitrary .html skeleton file, read configuration files that expose the site secret, and forge a signed AJAX context that executes the planted skeleton as PHP under the web-server user. The assessed impact is high across confidentiality, integrity, and availability (CVSS:3.1 AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H; vendor-scored 9.3), exploitation requires only that the Crayons plugin be installed and enabled below 3.5.0, and no public exploit code was identified at time of analysis though the flaw is trivially reachable and unauthenticated.