Acesec

The issue concerns SQL Injection in the constructSQL function, located in inc/search.class.php. This can be exploited by triggering a crafted LIMIT clause, for example, to front/computer.php.

The issue allows remote authenticated administrators to delete arbitrary files by crafting the `file` parameter in the `front/backup.php` script.

A SQL injection issue exists in the front/devicesoundcard.php file via the `start` parameter.

The issue concerns SQL Injection in the `crit` variable within the inc/computer softwareversion.class.php file, which can be exploited through the ajax/common.tabs.php endpoint.

The issue concerns SQL Injection in the condition rule field of GLPI, which can be exploited via the "front/rulesengine.test.php" API endpoint.

The issue allows SQL injection via an "ajax/getDropdownValue.php" request with an `entity restrict` parameter that is not a list of integers.