WS-2022-0403

A Path Traversal attack was discovered in ericferon/glpi-archimap that leads to Remote Code Execution via PHP file upload. An attacker could perform actions not intended by application like read, update or delete arbitrary files and directories stored on file system including application source...

WS-2022-0391

The GLPI's plugin named glpi-archimapcontains an ajax route named getconfig.php which allows a user to retrieve the plugin configuration. However, this route is accessible by everyone because there is no authentication check. Moreover, the attacker can inject his own SQL queries and get directly...