An unauthenticated remote code execution vulnerability in SPIP allows attackers to achieve arbitrary PHP function execution via malicious job queue injection.

The vulnerability exists in the editer_objet action where the arg parameter fails to enforce an allowlist for SQL table names, allowing unauthenticated attackers to inject malicious rows into the spip_jobs table. These injected rows are later unserialized and executed by the system cron job queue, leading to arbitrary PHP code execution.

This vulnerability carries a critical CVSS score of 9.8, reflecting the ability for an unauthenticated attacker to gain full control over the underlying server. Successful exploitation would lead to complete system compromise, potential data exfiltration, and the ability to pivot into internal network segments, causing severe reputational and operational damage.

Immediate Action: Upgrade SPIP to version 4.4.18 or higher immediately to apply the necessary allowlist constraints and prevent job queue injection.

Proactive Monitoring: Monitor server access logs for anomalous requests targeting the editer_objet action and audit the spip_jobs database table for unauthorized or suspicious entries.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block requests containing suspicious arg parameters or unexpected serialized PHP objects directed at the editer_objet endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the technical write-up provided by Lexfo.

Given the critical nature of this flaw and the availability of a public proof-of-concept, organizations must prioritize patching SPIP installations immediately. Do not delay in applying the 4.4.18 update, as the mechanism for exploitation is well-documented and presents a significant risk to the integrity and confidentiality of the host environment.