PT-2023-6847 · Glpi+2 · Glpi+2
Mmnhack
·
Publicado
2023-09-26
·
Atualizado
2024-05-22
·
CVE-2023-42461
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
GLPI versions prior to 10.0.10
Description
The issue is related to the use of the ITIL actors input field from the ticket form, which can be exploited to perform a SQL injection. This allows a remote attacker to potentially capture an administrator account by sending a specially crafted SQL query. GLPI is a free asset and IT management software package that provides ITIL service desk features, licenses tracking, and software auditing.
Recommendations
For versions prior to 10.0.10, upgrade to version 10.0.10 to resolve the issue. As a temporary workaround, consider restricting access to the ITIL actors input field from the ticket form to minimize the risk of exploitation. Avoid using the
ITIL actors input field in the affected ticket form until the issue is resolved.Exploit
Correção
SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Glpi
Red Os