An unauthenticated remote code execution and account takeover vulnerability in SPIP requires immediate patching to prevent full administrative compromise.

This is a missing authorization flaw (CWE-862) occurring within the ecrire/action/ administrative endpoints. Unauthenticated attackers can bypass the autoriser() permission check by providing a crafted HMAC-SHA256 nonce, enabling them to execute privileged functions like password resets.

The ability for an unauthenticated attacker to reset the administrator password poses a catastrophic risk to the integrity and confidentiality of the entire SPIP installation. Given the CVSS score of 9.8, this vulnerability is classified as critical, as it allows for complete system takeover, potential data exfiltration, and full administrative control over the affected web platform.

Immediate Action: Upgrade all SPIP installations to version 4.4.18 or later immediately to incorporate the required authorization checks.

Proactive Monitoring: Review web server access logs for suspicious requests targeting the ecrire/action/ directory, specifically looking for unusual patterns or failed attempts to invoke the editer_auteur action.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to block unauthorized access to the ecrire/action/ administrative path and inspect incoming HMAC-SHA256 requests for signs of manipulation.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the technical write-up provided by Lexfo at https://blog.lexfo.fr/casse-spip-sqli-to-rce.html.

This vulnerability represents a severe threat to your infrastructure and must be prioritized for remediation. Because the exploit allows for unauthenticated password resets of administrative accounts, the risk of total system compromise is extremely high. Please verify your current SPIP version and apply the 4.4.18 update immediately to neutralize this threat.