PT-2020-4301 · Teclib+1 · Glpi+1
Trasher
·
Published
2020-10-07
·
Updated
2024-05-22
·
CVE-2020-15226
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
GLPI versions prior to 9.5.2
Description:
The issue is related to a SQL Injection in the API's search function, allowing an attacker to break SQL syntax and utilize a UNION SELECT query to reflect sensitive information, such as the current database version or database user. This vulnerability is most likely to be exploited by someone with an API account to the system. The issue is related to incorrect neutralization of special elements used in SQL commands, which can allow a remote attacker to execute arbitrary SQL queries to the database by sending a specially crafted request to the vulnerable application.
Recommendations:
For versions prior to 9.5.2, update to version 9.5.2 to resolve the issue. As a temporary workaround, consider restricting access to the API's search function until the patch is applied. Avoid using the vulnerable search function in the API until the issue is resolved.
Exploit
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Glpi