PT-2018-11558
CVE-2018-13049
·
Published
2018-07-02
·
Updated
2018-08-30
Description by
CVSS 3.1
8.8
HighMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
GLPI versions 9.2.x through 9.3.0
Description
The issue concerns SQL Injection in the constructSQL function, located in inc/search.class.php. This can be exploited by triggering a crafted LIMIT clause, for example, to front/computer.php.
Recommendations
For GLPI versions 9.2.x through 9.3.0, consider restricting access to the constructSQL function in inc/search.class.php until a patch is available. As a temporary workaround, avoid using the LIMIT clause in the affected API endpoint to minimize the risk of exploitation.
Found an issue in the description? Have something to add? Feel free to write us 👾