The vulnerability is a classic SQL injection flaw (CWE‑89) that allows authenticated low‑privilege users to craft union‑based queries and, by leveraging PHP tag processing, to execute arbitrary code on the server. Attackers can remotely inject SQL, ultimately forcing the web application to evaluate PHP code that they supply. If exploited successfully, the attacker gains full control over the web server, enabling data theft, defacement, or further compromise. The flaw exists in SPIP prior to version 4.4.10 and does not affect newer releases.

Vendors: SPIP. Product: SPIP CMS. Affected releases are all versions before 4.4.10. Any installation of SPIP that has not been upgraded beyond this release is vulnerable.

The CVSS score of 8.7 indicates a high‑severity vulnerability. EPSS is less than 1 %, implying that exploitation is currently rare, and it is not listed in CISA’s KEV catalog. The attack requires an authenticated low‑privilege user; once inside the application, the attacker can manipulate the query “union” string and trigger PHP tag parsing to achieve remote code execution. Because the vector is web‑based, any publicly exposed SPIP instance that allows user registration or content editing could be targeted, provided the user has editor rights.