CVE-2020-15176 HIGH

CVE-2020-15176: SQL injection in GLPI

Vendor Glpi-Project
Product glpi
Weakness CWE-89 · SQLi
Published October 7, 2020
Last update August 4, 2024
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

What the vulnerability does

01Description

In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the application does not escape or sanitize allowing for SQL Injection to occur. Leveraging this vulnerability an attacker is able to exfiltrate sensitive information like passwords, reset tokens, personal details, and more. The issue is patched in version 9.5.2

Key dates

02Disclosure timeline

October 7, 2020 CVE published
August 4, 2024 Record updated