PT-2023-13340 · Glpi · Glpi Cartography Plugin

Nuri Çilengir · Published 2023-04-16 · Updated 2025-02-06 · CVE-2022-34128

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GLPI Cartography plugin versions prior to 6.0.1

Description The issue allows remote code execution via PHP code in the POST data to "front/upload.php". This enables an attacker to execute arbitrary PHP code on the server.

Recommendations For GLPI Cartography plugin versions prior to 6.0.1, update to version 6.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "front/upload.php" endpoint to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-34128

GHSA-947X-G9G9-RCMX

Affected Products

Glpi Cartography Plugin

References · 9

• 🔥 https://pentest.blog/advisory-glpi-service-management-software-sql-injection-remote-code-execution-and-local-file-inclusion · Exploit
• 🔥 https://exploit-db.com/exploits/51234 · Exploit
• https://osv.dev/vulnerability/CVE-2022-34128 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34128 · Security Note
• https://github.com/InfotelGLPI/positions/releases/tag/6.0.1 · Note
• https://github.com/InfotelGLPI/positions/security/advisories/GHSA-947x-g9g9-rcmx · Note
• https://t.me/cvenotify/110280 · Telegram Post
• https://t.me/cvenotify/48369 · Telegram Post
• https://t.me/cibsecurity/62243 · Telegram Post