A vulnerability has been reported in SPIP, which can be exploited by malicious people to conduct SQL injection attacks. Two additional vulnerabilities with unknown impacts have also been reported.

1) Input passed to the "ID" parameter in inc/rubriques.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

2) Two vulnerabilities exist due to unknown errors. No further information is currently available.

These vulnerabilities are reported in versions prior to 2.0.2.

Solution
Update to version 2.0.2

Provided and/or discovered by
1) Julien Cayssol
2) Jean Bon and Pierre Gardenat

Changelog
Further details available in Customer Area

Original Advisory
http://www.spip-contrib.net/SPIP-1-8-3b-1-9-2g-2-2

Deep Links
Links available in Customer Area