PT-2018-11558
CVE-2018-13049
·
تاريخ النشر
2018-07-02
·
تاريخ التحديث
2018-08-30
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
GLPI versions 9.2.x through 9.3.0
Description
The issue concerns SQL Injection in the constructSQL function, located in inc/search.class.php. This can be exploited by triggering a crafted LIMIT clause, for example, to front/computer.php.
Recommendations
For GLPI versions 9.2.x through 9.3.0, consider restricting access to the constructSQL function in inc/search.class.php until a patch is available. As a temporary workaround, avoid using the LIMIT clause in the affected API endpoint to minimize the risk of exploitation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾