SPIP before 4.4.29 Authenticated SQL Injection via where Parameter
Affects SPIP before 4.4.29 when an authenticated back-office user submits a differing where parameter in the POST body on /ecrire/?exec=articles. Fixed in 4.4.29.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 4.4.29
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. SPIP versions before 4.4.29 Attacker has authenticated back-office access Request submits a where parameter in the POST body that differs from the GET query string on /ecrire/?exec=articles
- Exploitation0/40No signal
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Reach: unknown (data gap). No tracked technology or package matched
- Severity7.1/10CVSS 7.1
- No patch0/5No signal
What would change the score
- Would score about 65 if added to CISA KEV
- Would score about 60 if CISA's SSVC rates exploitation active
- Would score about 22 if CISA's SSVC rates it automatable
CVE-2026-122032 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.1 (high) and affects SPIP; fixed in 4.4.29.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 15/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 4.4.29
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
SPIP, a content management system, is affected by an SQL injection flaw that lets an attacker with back-office login extract database contents, including protected articles and users' bcrypt password hashes. The bug is reached remotely over the network, and it requires the attacker to have a low-privilege account with back-office access.
Read the original description
SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing spip_sanitize_from_request() sanitization. Attackers can exploit this request parameter mismatch to extract database contents, including protected articles and bcrypt password hashes of users.
What to do
Check whether your setup matches what the bug needs.
SPIP versions before 4.4.29 Attacker has authenticated back-office access Request submits a where parameter in the POST body that differs from the GET query string on /ecrire/?exec=articlesUpgrade to a fixed version: 4.4.29.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- SPIP SPIP
fixed in 4.4.29
Evidence 3
- Patch
- Report
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-122032
Is CVE-2026-122032 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
A logged-in back-office user can alter a database query through the where parameter on the articles page, which lets them run arbitrary SQL. That can expose database contents, including protected articles and users' bcrypt password hashes.Source: vulncheck.com
Which versions are affected by CVE-2026-122032?
SPIP: before 4.4.29.Source: cve.now feed data
Am I affected, and how do I check?
SPIP versions before 4.4.29 are affected, but only when the request sends a where parameter in the POST body that differs from the GET query string on /ecrire/?exec=articles. To check, look at the SPIP version in the back office or its package files; a version below 4.4.29 is in the affected range.Source: vulncheck.com
How do I fix CVE-2026-122032?
Upgrade SPIP to version 4.4.29 or later, which contains the fix. No workaround is listed in the facts.Source: vulncheck.com