PT-2014-8909

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 0.85.1 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the condition parameter in the "ajax/getDropdownValue.php" endpoint. Recommendations For versions pri...

CVE-2014-9258: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ajax/getDropdownValue.php in GLPI before 0.85.1 allows remote authenticated users to execute arbitrary SQL commands via the condition parameter...

GLPI 0.85 - Blind SQL Injection

GLPI 0.85 - Blind SQL Injection Exploit Title: GLPI 0.85 Blind SQL Injection Date: 28-11-2014 Exploit Author: Kacper Szurek - http://security.szurek.pl/ http://twitter.com/KacperSzurek Software Link: https://forge.indepnet.net/attachments/download/1899/glpi-0.85.tar.gz CVE: CVE-2014-9258 Category...

GLPI 0.85 - Blind SQL Injection

Exploit Title: GLPI 0.85 Blind SQL Injection Date: 28-11-2014 Exploit Author: Kacper Szurek - http://security.szurek.pl/ http://twitter.com/KacperSzurek Software Link: https://forge.indepnet.net/attachments/download/1899/glpi-0.85.tar.gz CVE: CVE-2014-9258 Category: webapps 1. Description...