Teclib GLPI <= 9.3.3 - Unauthenticated SQL Injection

Teclib GLPI = 9.3.3 exposes a script /scripts/unlocktasks.php that incorrectly sanitizes user controlled data before using it in SQL queries. Thus, an attacker could abuse the affected feature to alter the semantic original SQL query and retrieve database records. id: CVE-2019-10232 info: name:...

UBUNTU-CVE-2019-10232

Teclib GLPI through 9.3.3 has SQL injection via the "cycle" parameter in /scripts/unlocktasks.php...

CVE-2019-10232

Teclib GLPI versions through 9.3.3 are vulnerable to an unauthenticated SQL injection flaw in the /scripts/unlock_tasks.php script. The root cause is the incorrect sanitization of user-controlled data provided via the "cycle" parameter, which allows an attacker to alter the semantic original SQL ...