CVE-2017-15736

What it actually does

Stored cross-site scripting flaw that allows arbitrary HTML or script injection into persisted content via unsanitized fields such as PGP metadata, executed in the context of other users' browsers when the affected pages are rendered.

Why it matters to the business

Attackers can hijack user sessions, steal credentials or sensitive data displayed to administrators, and perform unauthorized actions within the application on behalf of victims, leading to data exposure and potential account compromise across the user base.

How an attack unfolds

An attacker submits a crafted payload containing script tags or event handlers into a field such as the PGP field; the input is stored without proper sanitization; when any user or administrator later views the affected author or content page the malicious script executes in their browser, enabling theft of cookies or session tokens.

How to fix it

Upgrade SPIP to version 3.1.7 or later. After upgrading, review and sanitize any existing stored content that may contain previously injected scripts. Restrict or monitor fields that accept raw HTML until the update is complete.

How to confirm the fix worked

Confirm the installed SPIP version is 3.1.7 or newer. Reproduce the original input vector with a benign test payload and verify that the output is properly escaped. Scan the relevant template and helper files for updated sanitization logic.

Typical attack path

1. Identify a publicly accessible input field that accepts user-controlled strings and is later displayed without escaping.
2. Craft and submit a payload containing executable script or HTML that targets the stored content path.
3. Verify the payload is persisted in the database or page source.
4. Wait for or lure a privileged user to view the affected page so the script executes in their session context.
5. Use the resulting browser context to exfiltrate data or perform further actions.

How to detect it

Review web server and application logs for requests containing script tags or encoded payloads submitted to author or profile update endpoints. Inspect stored content in the database for unexpected HTML or script elements. Check rendered pages for injected script sources or event handlers originating from user-controlled fields.

What your security team should do

• Apply the 3.1.7 or newer update immediately given the public disclosure date and persistent stored nature of the flaw.
• Audit all user-generated content fields for prior injection and remove or neutralize any suspicious scripts.
• Implement web application firewall rules or content security policy headers as a compensating control until patching is complete.
• Monitor access logs for unusual requests to author or content rendering endpoints.