CVE-2020-15226

In GLPI before version 9.5.2, there is a SQL Injection in the API's search function. Not only is it possible to break the SQL syntax, but it is also possible to utilise a UNION SELECT query to reflect sensitive information such as the current database version, or database user. The most likely scenario for this vulnerability is with someone who has an API account to the system. The issue is patched in version 9.5.2. A proof-of-concept with technical details is available in the linked advisory.
Configurations

Configuration 1 (hide)

cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-10-07 20:15

Updated : 2024-02-04 21:23


NVD link : CVE-2020-15226

Mitre link : CVE-2020-15226

CVE.ORG link : CVE-2020-15226


JSON object : View

Products Affected

glpi-project

  • glpi
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')