EUVD-2020-20169

Malware in sbrugna...

CVE-2020-27662: Authorization Bypass Through User-Controlled Key

In GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference IDOR vulnerability that allows an attacker to read data from any database table e.g., glpitickets, glpiusers, etc...