CVE-2026-27743
Unauthenticated SQL Injection in SPIP referer_spam Plugin Allows Remote Attacks
Publication date: 2026-02-25
Last updated on: 2026-03-03
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| spip | referer_spam | to 1.3.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-27743 is a critical unauthenticated SQL injection vulnerability in the SPIP referer_spam plugin versions prior to 1.3.0.'}, {'type': 'paragraph', 'content': 'The vulnerability exists in the referer_spam_ajouter and referer_spam_supprimer action handlers, which take a URL parameter from GET requests and directly insert it into SQL LIKE clauses without any input validation or parameterization.'}, {'type': 'paragraph', 'content': "These endpoints do not enforce authorization checks and do not use SPIP's action protection mechanisms such as securiser_action(), allowing remote attackers to execute arbitrary SQL queries without authentication."}] [1]
How can this vulnerability impact me? :
This vulnerability allows remote attackers to execute arbitrary SQL queries on the affected system without any authentication.
Because the attack vector is network-based with low complexity and no privileges or user interaction required, attackers can exploit this vulnerability easily.
The impact is high on confidentiality and integrity, meaning attackers could access, modify, or delete sensitive data stored in the database.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for unauthorized or suspicious GET requests to the referer_spam_ajouter and referer_spam_supprimer action handlers that include a url parameter. Since these endpoints do not require authentication and directly interpolate the url parameter into SQL queries, unusual or malformed URL parameters in requests to these handlers may indicate exploitation attempts.'}, {'type': 'paragraph', 'content': 'You can use network monitoring or web server access logs to identify such requests. For example, using command-line tools like grep on your web server logs to find requests to these endpoints:'}, {'type': 'list_item', 'content': "grep 'referer_spam_ajouter' /path/to/access.log"}, {'type': 'list_item', 'content': "grep 'referer_spam_supprimer' /path/to/access.log"}, {'type': 'paragraph', 'content': 'Additionally, you can look for suspicious url parameter values that contain SQL syntax or unusual characters that might indicate an injection attempt.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the SPIP referer_spam plugin to version 1.3.0 or later, where this vulnerability has been fixed by applying proper input validation, parameterization, and SPIP action protections.
If upgrading immediately is not possible, consider restricting access to the vulnerable endpoints (referer_spam_ajouter and referer_spam_supprimer) by implementing network-level controls such as firewall rules or web application firewall (WAF) rules to block unauthorized requests.
Monitoring and alerting on suspicious requests to these endpoints can also help in early detection and response.