CVEvulnerability
CVE-2013-2226
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2014-05-14
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
Multiple SQL injection vulnerabilities in GLPI before 0.83.9 allow remote attackers to execute arbitrary SQL commands via the (1) users_id_assign parameter to ajax/ticketassigninformation.php, (2) filename parameter to front/document.form.php, or (3) table parameter to ajax/comments.php.
Affected configurations
• glpi-project glpi (<= 0.83.8)
• glpi-project glpi 0.83
• glpi-project glpi 0.83.1
• glpi-project glpi 0.83.2
• glpi-project glpi 0.83.3
• glpi-project glpi 0.83.4
• glpi-project glpi 0.83.5
• glpi-project glpi 0.83.6
• glpi-project glpi 0.83.7
• glpi-project glpi 0.83.31
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://www.glpi-project.org/spip.php?page=annonce&id_breve=297&lang=en&debut_autres_breves= Patch, Vendor Advisory
- http://www.securityfocus.com/bid/60693 Exploit
- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5146.php Exploit
- http://www.glpi-project.org/spip.php?page=annonce&id_breve=297&lang=en&debut_autres_breves= Patch, Vendor Advisory
- http://www.securityfocus.com/bid/60693 Exploit
- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5146.php Exploit