The vulnerability of the GLPI system’s handling of requests and incidents lies in the improper cancellation of input during the generation of web pages, allowing a malicious user to execute arbitrary SQL queries in the database.

GLPI allows SQL injection from improper input handling and cross-site scripting from uncleaned search data.

Reporter	Title	Published	Views	Family All 153
FreeBSD	glpi -- multiple vulnerabilities	20 Mar 202300:00	–	freebsd
BDU FSTEC	The vulnerability of the GLPI system’s handling of requests and incidents lies in the improper neutralization of input data during the generation of web pages, as well as the improper neutralization of special elements used in SQL commands. This allows attackers to execute arbitrary SQL queries in the database.	26 Jun 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the GLPI system’s handling of requests and incidents, related to improper neutralization of special elements used in SQL commands, allows attackers to execute arbitrary SQL queries in the database.	26 Jun 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the GLPI system’s request and incident handling process, related to improper input cancellation during the generation of web pages, allows attackers to carry out attacks using cross-site scripts.	26 Jun 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Fields plugin in the GLPI request and incident management system allows a hacker to write data into any field, including those for which he does not have access.	26 Jun 202300:00	–	bdu_fstec
Circl	CVE-2023-28855	5 Apr 202322:38	–	circl
CNNVD	GLPI 安全漏洞	5 Apr 202300:00	–	cnnvd
CNNVD	GLPI SQL注入漏洞	5 Apr 202300:00	–	cnnvd
CNNVD	GLPI SQL注入漏洞	5 Apr 202300:00	–	cnnvd
CNNVD	GLPI 跨站脚本漏洞	5 Apr 202300:00	–	cnnvd

Vulners

Node

indepnet glpiRange<9.5.13

indepnet glpiRange<10.0.7

Source	Link
redos	www.redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-glpi-cve-2023-28855-cve-2023-28852-cve-2023-28849-cve-2023-28838-cve-2023/
github	www.github.com/glpi-project/glpi/releases/tag/10.0.7
github	www.github.com/glpi-project/glpi/releases/tag/9.5.13
github	www.github.com/glpi-project/glpi/security/advisories/GHSA-r93q-chh5-jgh4
redos	www.redos.red-soft.ru/support/secure/
web	www.web.nvd.nist.gov/view/vuln/detail

26 Jun 2023 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 36.1

CVSS 26.4

EPSS0.00766