3430 matches found
Sql injection
SQL injection vulnerability in ajax/getDropdownValue.php in GLPI before 0.85.1 allows remote authenticated users to execute arbitrary SQL commands via the condition parameter...
UBUNTU-CVE-2014-9258
SQL injection vulnerability in ajax/getDropdownValue.php in GLPI before 0.85.1 allows remote authenticated users to execute arbitrary SQL commands via the condition parameter...
CVE-2014-9258
SQL injection vulnerability in ajax/getDropdownValue.php in GLPI before 0.85.1 allows remote authenticated users to execute arbitrary SQL commands via the condition parameter...
CVE-2014-9258
GLPI vulnerable component: ajax/getDropdownValue.php in GLPI before 0.85.1. Root cause: SQL injection via the condition parameter allowing remote authenticated users to execute arbitrary SQL commands. Impact: partial confidentiality and integrity, as per CVSS context (base score 6.5, medium). Rem...
CVE-2014-9258
SQL injection vulnerability in ajax/getDropdownValue.php in GLPI before 0.85.1 allows remote authenticated users to execute arbitrary SQL commands via the condition parameter...
CVE-2014-9258
SQL injection vulnerability in ajax/getDropdownValue.php in GLPI before 0.85.1 allows remote authenticated users to execute arbitrary SQL commands via the condition parameter...
PT-2014-8909
Name of the Vulnerable Software and Affected Versions GLPI versions prior to 0.85.1 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the condition parameter in the "ajax/getDropdownValue.php" endpoint. Recommendations For versions pri...
CVE-2014-9258: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in ajax/getDropdownValue.php in GLPI before 0.85.1 allows remote authenticated users to execute arbitrary SQL commands via the condition parameter...
GLPI 0.85 - Blind SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: GLPI 0.85 Blind SQL Injection Date: 28-11-2014 Exploit Author: Kacper Szurek - http://security.szurek.pl/ http://twitter.com/KacperSzurek Software Link: https://forge.indepnet.net/attachments/download/1899/glpi-0.85.tar.gz CVE:...
GLPI 0.85 - Blind SQL Injection
GLPI 0.85 - Blind SQL Injection Exploit Title: GLPI 0.85 Blind SQL Injection Date: 28-11-2014 Exploit Author: Kacper Szurek - http://security.szurek.pl/ http://twitter.com/KacperSzurek Software Link: https://forge.indepnet.net/attachments/download/1899/glpi-0.85.tar.gz CVE: CVE-2014-9258 Category...
GLPI 0.85 - Blind SQL Injection
Exploit Title: GLPI 0.85 Blind SQL Injection Date: 28-11-2014 Exploit Author: Kacper Szurek - http://security.szurek.pl/ http://twitter.com/KacperSzurek Software Link: https://forge.indepnet.net/attachments/download/1899/glpi-0.85.tar.gz CVE: CVE-2014-9258 Category: webapps 1. Description...
PT-2015-4032
Name of the Vulnerable Software and Affected Versions GLPI versions prior to 0.84.8 Description The issue allows remote attackers to include and execute arbitrary local files via a .. dot dot underscore in an item type to the getItemForItemtype. This can be demonstrated by the itemtype parameter ...
PT-2015-3786
Name of the Vulnerable Software and Affected Versions GLPI versions prior to 0.84.7 Description The issue allows remote attackers to obtain sensitive information due to improper access restriction to cost information. This can be achieved via the cost criteria in the search bar. Recommendations F...
GLPI 0.84.1 - Multiple Vulnerabilities
No description provided by source...
GLPI 0.83.8 - Multiple Vulnerabilities
No description provided by source...
GLPI 0.71.3 - Multiple Remote SQL Injection VUlnerabilities
No description provided by source. + Application : GLPI v 0.71.3 + App'z URI : http://glpi-project.org + Bug : Multiple Remote SQL Injections + Author : Zigma + Home : http://NullArea.Net Let's have a look on the Security System GLPI uses : --- \inc\includes.php --- // Security system if isset$PO...
GLPI 0.83.9 'unserialize()' Function Remote Code Execution Vulnerability
No description provided by source. Source: http://www.securityfocus.com/bid/60823/info GLPI is prone to a remote PHP code-execution vulnerability. An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the affected application. This may facilitate a compromi...
GLPI install.php Remote Command Execution
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...
CVE-2013-2225
CVE-2013-2225 affects GLPI: inc/ticket.class.php in GLPI 0.83.9 and earlier allows remote attackers to unserialize arbitrary PHP objects via _predefined_fields in front/ticket.form.php. OpenVAS/Mageia advisories confirm the issue and indicate a fix was released: upgrade to GLPI 0.83.91 (and patch...