The referer_spam plugin for SPIP before version 1.3.0 contains an unauthenticated SQL injection flaw. Attackers can pass a crafted URL parameter via a GET request to the referer_spam_ajouter or referer_spam_supprimer actions. The plugin directly inserts the parameter into SQL LIKE clauses without validation or parameterization, and the endpoints lack any authorization checks. This enables arbitrary SQL queries to be executed against the backend database, potentially allowing data theft, corruption, or further compromise of the host if the database privileges are high.

All SPIP installations that use the referer_spam plugin with a version earlier than 1.3.0 are affected. The vulnerability resides within the plugin itself, but the underlying SPIP application (any version that supports the plugin) must also be present. No specific operating system or database versions are enumerated, so any system running the plugin is potentially compromised.

The vulnerability carries a CVSS score of 9.3, indicating critical severity. The EPSS score of below 1% suggests that, while the flaw is severe, the likelihood of exploitation at the moment is low. Publicly listed references do not include the vulnerability in CISA’s KEV catalog. Exploitation requires only that an unauthenticated HTTP GET request reach the vulnerable endpoints, which can be achieved by a remote attacker with network access to the web server. If the web application is exposed to the internet, the risk remains high until corrected.