Read the docs
TI-2008-05519 Aliases CVE-2008-5813GHSA-wj8j-58jx-v347

SQL injection vulnerability in inc/rubriques.php in SPIP 1.8 before 1.8.3b, 1.9 before…

Priority LOW 35CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

SQL injection vulnerability in inc/rubriques.php in SPIP 1.8 before 1.8.3b, 1.9 before 1.9.2g, and 2.0 before 2.0.2 allows remote attackers to execute arbitrary SQL commands via the ID parameter. NOTE: some of these details are obtained from third party information.

Why it matters now

EPSS 0.01286 70th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:a:spip:spip:1.8:*:*:*:*:*:*:*1.8VulnerableSPIP
cpe:2.3:a:spip:spip:1.8.1:*:*:*:*:*:*:*1.8.1VulnerableSPIP
cpe:2.3:a:spip:spip:1.8.2:*:*:*:*:*:*:*1.8.2VulnerableSPIP
cpe:2.3:a:spip:spip:1.8.2b:*:*:*:*:*:*:*1.8.2bVulnerableSPIP
cpe:2.3:a:spip:spip:1.8.3:*:*:*:*:*:*:*1.8.3VulnerableSPIP
cpe:2.3:a:spip:spip:1.8b1:*:*:*:*:*:*:*1.8b1VulnerableSPIP
cpe:2.3:a:spip:spip:1.8b2:*:*:*:*:*:*:*1.8b2VulnerableSPIP
cpe:2.3:a:spip:spip:1.8b3:*:*:*:*:*:*:*1.8b3VulnerableSPIP
cpe:2.3:a:spip:spip:1.8b4:*:*:*:*:*:*:*1.8b4VulnerableSPIP
cpe:2.3:a:spip:spip:1.8b5:*:*:*:*:*:*:*1.8b5VulnerableSPIP
  • cpe:2.3:a:spip:spip:1.8:*:*:*:*:*:*:* Versions 1.8 Vulnerable ·SPIP
  • cpe:2.3:a:spip:spip:1.8.1:*:*:*:*:*:*:* Versions 1.8.1 Vulnerable ·SPIP
  • cpe:2.3:a:spip:spip:1.8.2:*:*:*:*:*:*:* Versions 1.8.2 Vulnerable ·SPIP
  • cpe:2.3:a:spip:spip:1.8.2b:*:*:*:*:*:*:* Versions 1.8.2b Vulnerable ·SPIP
  • cpe:2.3:a:spip:spip:1.8.3:*:*:*:*:*:*:* Versions 1.8.3 Vulnerable ·SPIP
  • cpe:2.3:a:spip:spip:1.8b1:*:*:*:*:*:*:* Versions 1.8b1 Vulnerable ·SPIP
  • cpe:2.3:a:spip:spip:1.8b2:*:*:*:*:*:*:* Versions 1.8b2 Vulnerable ·SPIP
  • cpe:2.3:a:spip:spip:1.8b3:*:*:*:*:*:*:* Versions 1.8b3 Vulnerable ·SPIP
  • cpe:2.3:a:spip:spip:1.8b4:*:*:*:*:*:*:* Versions 1.8b4 Vulnerable ·SPIP
  • cpe:2.3:a:spip:spip:1.8b5:*:*:*:*:*:*:* Versions 1.8b5 Vulnerable ·SPIP
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:spip:spip:1.8b6:*:*:*:*:*:*:*1.8b6VulnerableSPIP
cpe:2.3:a:spip:spip:1.9.0:*:*:*:*:*:*:*1.9.0VulnerableSPIP
cpe:2.3:a:spip:spip:1.9.1:rev7385:*:*:*:*:*:*1.9.1 rev7385VulnerableSPIP
cpe:2.3:a:spip:spip:1.9.1:rev7502:*:*:*:*:*:*1.9.1 rev7502VulnerableSPIP
cpe:2.3:a:spip:spip:1.9.2:*:*:*:*:*:*:*1.9.2VulnerableSPIP
cpe:2.3:a:spip:spip:1.9.2f:*:*:*:*:*:*:*1.9.2fVulnerableSPIP
cpe:2.3:a:spip:spip:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableSPIP
cpe:2.3:a:spip:spip:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableSPIP
  • cpe:2.3:a:spip:spip:1.8b6:*:*:*:*:*:*:* Versions 1.8b6 Vulnerable ·SPIP
  • cpe:2.3:a:spip:spip:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·SPIP
  • cpe:2.3:a:spip:spip:1.9.1:rev7385:*:*:*:*:*:* Versions 1.9.1 rev7385 Vulnerable ·SPIP
  • cpe:2.3:a:spip:spip:1.9.1:rev7502:*:*:*:*:*:* Versions 1.9.1 rev7502 Vulnerable ·SPIP
  • cpe:2.3:a:spip:spip:1.9.2:*:*:*:*:*:*:* Versions 1.9.2 Vulnerable ·SPIP
  • cpe:2.3:a:spip:spip:1.9.2f:*:*:*:*:*:*:* Versions 1.9.2f Vulnerable ·SPIP
  • cpe:2.3:a:spip:spip:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·SPIP
  • cpe:2.3:a:spip:spip:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·SPIP

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-5813
  2. 2026-10-03 Alias added: GHSA-wj8j-58jx-v347

References

Patch 1

  • TI-2023-12107 SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because… CVSS 3.1CRITICAL 9.8
  • TI-2024-07895 SPIP Bigup Multipart File Upload OS Command Injection CVSS 3.1CRITICAL 9.8
  • TI-2022-17317 RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter. CVSS 3.1HIGH 8.8
  • TI-2024-35862 An authenticated arbitrary file upload vulnerability in the Documents module of SPIP… CVSS 3.1MEDIUM 6.3
  • TI-2023-30183 Spip 4.1.10 Admin Account Spoofing via Malicious SVG Upload CVSS 4.0MEDIUM 4.8
  • TI-2013-04002 The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used… CVSS 2.0HIGH 7.5
See all 68 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences