PT-2023-13340 · Glpi · Glpi Cartography Plugin

Nuri Çilengir · Publicado 2023-04-16 · Atualizado 2025-02-06 · CVE-2022-34128

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GLPI Cartography plugin versions prior to 6.0.1

Description The issue allows remote code execution via PHP code in the POST data to "front/upload.php". This enables an attacker to execute arbitrary PHP code on the server.

Recommendations For GLPI Cartography plugin versions prior to 6.0.1, update to version 6.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "front/upload.php" endpoint to minimize the risk of exploitation.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2022-34128

GHSA-947X-G9G9-RCMX

Produtos afetados

Glpi Cartography Plugin

Referências · 9

• 🔥 https://pentest.blog/advisory-glpi-service-management-software-sql-injection-remote-code-execution-and-local-file-inclusion · Exploit
• 🔥 https://exploit-db.com/exploits/51234 · Exploit
• https://github.com/InfotelGLPI/positions/releases/tag/6.0.1 · Nota
• https://github.com/InfotelGLPI/positions/security/advisories/GHSA-947x-g9g9-rcmx · Nota
• https://t.me/cvenotify/110280 · Publicação no Telegram
• https://t.me/cvenotify/48369 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-34128 · Aviso do Fabricante
• https://t.me/cibsecurity/62243 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-34128 · Nota de Segurança