Threats tagged 'ghsa-hjqm-w8hv-xfp6'

SPIP versions prior to 4.4.29 contain a SQL injection vulnerability affecting authenticated users with back-office access. The flaw arises from a mismatch in sanitization between the POST body and GET query string parameters on the /ecrire/?exec=articles endpoint, allowing attackers to inject arbitrary SQL. Exploitation can lead to unauthorized extraction of database contents, including protected articles and bcrypt password hashes. The vulnerability has a CVSS score of 6.5, indicating medium severity. No patch or fixed version is explicitly stated in the provided data.