PT-2012-3035 · Glpi · Glpi

Emilien Girault · Published 2012-07-12 · Updated 2012-07-16 · CVE-2012-1037

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GLPI versions 0.78 through 0.80.61

Description The issue allows remote authenticated users to execute arbitrary PHP code via a URL in the sub type parameter in the front/popup.php file.

Recommendations For GLPI versions 0.78 through 0.80.61, update to a version that contains a fix for this issue to prevent remote execution of arbitrary PHP code.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2012-1037

Affected Products

Glpi

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2012-1037 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2012:016 · Vendor Advisory
• https://forge.indepnet.net/projects/glpi/repository/revisions/17457/diff/branches/0.80-bugfixes/front/popup.php · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1037 · Note
• http://seclists.org/fulldisclosure/2012/Feb/157 · Note
• https://forge.indepnet.net/issues/3338 · Note
• https://forge.indepnet.net/projects/glpi/versions/685 · Note