In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the application does not escape or sanitize allowing for SQL Injection to occur. Leveraging this vulnerability an attacker is able to exfiltrate sensitive information like passwords, reset tokens, personal details, and more. The issue is patched in version 9.5.2
References
Link | Resource |
---|---|
https://github.com/glpi-project/glpi/commit/f021f1f365b4acea5066d3e57c6d22658cf32575 | Patch Third Party Advisory |
https://github.com/glpi-project/glpi/security/advisories/GHSA-x93w-64x9-58qw | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: GitHub_M
Published: 2020-10-07T18:55:12
Updated: 2020-10-07T18:55:12
Reserved: 2020-06-25T00:00:00
Link: CVE-2020-15176
JSON object: View
NVD Information
Status : Analyzed
Published: 2020-10-07T19:15:12.720
Modified: 2020-10-16T15:36:03.727
Link: CVE-2020-15176
JSON object: View
Redhat Information
No data.
CWE