CVE-2020-15226

CVE-2020-15226 refers to a SQL Injection in GLPI’s API search function, impacting GLPI versions before 9.5.2. Successful exploitation could allow an attacker with an API account to craft a query (including UNION SELECT) to disclose sensitive information such as the database version or user. The i...

CVE-2020-15226 SQL Injection in GLPI Search API

In GLPI before version 9.5.2, there is a SQL Injection in the API's search function. Not only is it possible to break the SQL syntax, but it is also possible to utilise a UNION SELECT query to reflect sensitive information such as the current database version, or database user. The most likely...