SPIP referer_spam <= 1.2.1 Unauthenticated SQL Injection

The SQL injection vulnerability in the referer_spam plugin allows attackers to directly manipulate SQL queries without authentication. By crafting malicious URL parameters, an attacker can bypass security controls and execute arbitrary SQL commands against the SPIP database. This could lead to the extraction of sensitive data, including user credentials, configuration information, and potentially even the complete compromise of the website. The lack of authorization checks makes this vulnerability particularly dangerous, as it can be exploited remotely without any prior authentication. Successful exploitation could also enable attackers to modify or delete data, leading to denial of service or further system compromise.

Websites and applications utilizing SPIP CMS with the referer_spam plugin installed in versions 0.0 through 1.3.0 are at risk. This includes sites with limited security expertise or those relying on outdated plugin versions. Shared hosting environments using SPIP are particularly vulnerable due to the potential for cross-site contamination.

• php: Examine web server access logs for requests to refererspamajouter and refererspamsupprimer containing unusual characters or SQL keywords in the url parameter.

grep -i 'SELECT|INSERT|UPDATE|DELETE|UNION|DROP' /var/log/apache2/access.log | grep referer_spam

• php: Search plugin files for instances of direct SQL query construction using user-supplied input without proper sanitization or parameterization.

find /var/www/html/ -name 'referer_spam*' -print0 | xargs -0 grep -i 'mysql_query'

• generic web: Monitor for unusual database activity or errors in application logs that might indicate a successful SQL injection attempt.

1. 2026-02-25Disclosure

   disclosure

1. Reserviert2026-02-23
2. Veröffentlicht2026-02-25
3. Geändert2026-03-05
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-27743 is to immediately upgrade the SPIP refererspam plugin to version 1.3.0 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter out suspicious SQL injection attempts targeting the refererspamajouter and refererspam_supprimer endpoints. Specifically, look for url= parameters containing SQL keywords or special characters. Additionally, review and restrict access to the SPIP database to limit the potential impact of a successful attack. After upgrading, verify the fix by attempting to inject a simple SQL query (e.g., 1=1) through the vulnerable endpoints and confirming that it is properly sanitized.