Exploit for Injection in Glpi-Project Glpi

CVE-2022-35914poc Modified for GLPI Offsec Lab: calluserfun...

ROS-20240812-06

A vulnerability in GLPI's asset management and data center software is related to the The introduction of a malicious link by an unauthenticated user. Exploitation of the vulnerability could allow an attacker acting remotely to conduct an XSS attack Vulnerability in GLPI's request, incident and...

ROS-20240812-13

A vulnerability in GLPI's asset and data center management software involves server-side request forgery. Exploitation of the vulnerability could allow an attacker acting remotely to perform an SSRF-based attack using the creation of an arbitrary object. remotely to execute an SSRF-based attack...

ROS-20240812-03

The vulnerability in GLPI's asset and data center management software is related to the the injection of commands into a specific workflow that an agent would run with the privileges it uses privileges. Exploitation of the vulnerability could allow an attacker acting remotely to escalate its...

ROS-20240812-02

A vulnerability in the GLPI plugin that allows the creation of custom Formcreator forms is related to the the use of FULLFORM for rendering. Exploitation of the vulnerability could allow an attacker, acting remotely, to execute arbitrary javascript code...

ROS-20240812-12

Vulnerability of GLPI system of requests, incidents and inventory of computer equipment is related to Failure to take measures to protect the SQL query structure. Exploitation of the vulnerability could allow an attacker, acting remotely, to execute arbitrary SQL queries...

ROS-20240812-11

The GLPI Agent universal control agent vulnerability involves modifying GLPI-Agent code or allows a DLL to be used to modify the agent's logic. Exploitation of the vulnerability could allow an attacker to privilege escalation...

ROS-20240729-07

Vulnerability in the GLPI request and incident handling system related to improper privilege management. privileges. Exploitation of the vulnerability could allow an attacker acting remotely to steal confidential information Vulnerability in the GLPI reporting plugin is related to improper...

The vulnerability in the GLPI system’s handling of requests and incidents, related to improper neutralization of special elements used in SQL commands, allows an attacker to carry out an attack based on time, using SQL injections in the REST API user_token.

The vulnerability of the GLPI system for handling requests and incidents is related to the improper neutralization of certain special elements. Exploiting this vulnerability allows a malicious actor to scan server ports or services, and to carry out attacks based on timing, using SQL injections i...

The vulnerability of the GLPI system’s handling of requests and incidents, related to insufficient protection of user credentials, allows a malicious individual to obtain unauthorized access to the root account’s password.

The vulnerability in the GLPI system’s request and incident handling process is related to an error in passing configuration data via JavaScript. In this error, some records are filtered out, but the ldappass variable is not filtered. Exploiting this vulnerability could allow a remote attacker to...

The vulnerability of the GLPI system’s handling of requests and incidents is related to improper cancellation of input data during the generation of web pages. This allows a malicious user to gain unauthorized access to GLPI administrator’s cookie files.

The vulnerability of the GLPI request and incident handling system lies in the fact that the registration key is not properly encrypted on the configuration page for the registration key. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to the...

The vulnerability of the GLPI system’s request and incident handling process, related to improper elimination of input data during the generation of web pages, allows a malicious actor to create malicious external links.

The vulnerability of the GLPI system for handling requests and incidents is related to the improper elimination of input data during the generation of the web page. Exploiting this vulnerability allows a malicious actor to create a malicious external link...

The vulnerability of the GLPI system’s handling of requests and incidents, related to the falsification of requests on the server side, allows a perpetrator to scan the server’s ports or services that are open on the GLPI server or its private network.

The vulnerability of the GLPI request and incident handling system lies in the fact that using RSS channels or an external calendar for planning is vulnerable to an SSRF exploit. Exploiting this vulnerability allows a malicious actor to scan server ports or services that are open on the GLPI serv...

The vulnerability of the GLPI system’s request and incident handling process, related to incorrect input cancellation during the generation of web pages, allows a malicious attacker to carry out XSS attacks.

The vulnerability in the GLPI request and incident handling system relates to the lack of proper cleaning of external links. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks...

The vulnerability of the GLPI system’s handling of requests and incidents, related to the possibility of falsifying requests on the server side, allows a perpetrator to redirect users to any arbitrary URL address.

The vulnerability in the GLPI system for handling requests and incidents is related to the possibility of forged requests on the server side. Exploiting this vulnerability allows a malicious actor to redirect users to an arbitrary URL address...

ROS-20240729-03

A vulnerability in the GLPI reports plugin of the GLPI reports system is related to incorrect neutralization of input data during web page generation. neutralization of input data during web page generation. Exploitation of the vulnerability could allow a remote attacker to conduct XSS attacks...

The vulnerability of the GLPI system’s request and incident handling process, related to incorrect input cancellation during the generation of web pages, allows attackers to carry out attacks using cross-site scripting.

The vulnerability of the GLPI request and incident handling system is related to the use of ticket actions or the configuration of messages that include links to style sheets. Exploiting this vulnerability allows a malicious actor to carry out an attack using cross-site scripting...

The vulnerability of the GLPI system’s request and incident handling process, related to improper neutralization of special elements used in SQL commands, allows attackers to compromise the integrity of the system.

The vulnerability of the GLPI request and incident handling system lies in the lack of proper validation of input requests within the plugin controller, and the use of low-level plugin APIs for access. Exploitation of this vulnerability could allow a malicious actor to scan server ports or...

The vulnerability of the GLPI system’s handling of requests and incidents arises from the improper neutralization of input data during the generation of web pages. This allows attackers to carry out XSS attacks.

The vulnerability in the GLPI request and incident handling system relates to the improper elimination of input data during the generation of web pages. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks...

ROS-20240726-01

A vulnerability in GLPI's request and incident handling system is related to improper input validation. Exploitation of the vulnerability could allow an attacker acting remotely to impact the system integrity A vulnerability in the GLPI request and incident handling system is associated with the...