PT-2013-5732 · Glpi · Glpi

Published 2013-09-20 · Updated 2013-09-23 · CVE-2013-5696

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 0.84.2

Description The issue concerns a lack of proper security measures after the installation of GLPI, allowing remote attackers to conduct cross-site request forgery (CSRF) attacks. This can lead to two main consequences: (1) performing a SQL injection via an Etape 4 action, and (2) executing arbitrary PHP code via an update 1 action.

Recommendations For versions prior to 0.84.2, update to version 0.84.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the inc/central.class.php file and the install/install.php script to minimize the risk of exploitation. Avoid using the Etape 4 and update 1 actions in the affected API endpoints until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2013-5696

MGASA-2013-0288

Affected Products

Glpi

References · 17

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/glpi_install_rce.rb · Exploit
• 🔥 https://navixia.com/blog/entry/navixia-finds-critical-vulnerabilities-in-glpi-cve-2013-5696.html · Exploit
• 🔥 https://exploit-db.com/exploits/28483 · Exploit
• 🔥 https://exploit-db.com/exploits/28685 · Exploit
• https://advisories.mageia.org/MGASA-2013-0288.html · Security Note
• http://glpi-project.org/spip.php?page=annonce&id_breve=308 · Patch
• https://forge.indepnet.net/projects/glpi/repository/revisions/21753/diff/branches/0.84-bugfixes/inc/central.class.php · Patch
• https://cve.org/CVERecord?id=CVE-2013-5696 · Security Note
• https://forge.indepnet.net/projects/glpi/repository/revisions/21753 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2013-5696 · Security Note
• https://ubuntu.com/security/CVE-2013-5696 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-5696 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2013-0288 · Vendor Advisory
• https://bugs.mageia.org/show_bug.cgi?id=10579 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5696 · Note