CVE-2012-1037: Code Injection
Published Jul 12, 2012
·Updated
PHP remote file inclusion vulnerability in front/popup.php in GLPI 0.78 through 0.80.61 allows remote authenticated users to execute arbitrary PHP code via a URL in the subtype parameter.
Affected Software
14 affected components
GLPI-PROJECT GLPI=0.78
GLPI-PROJECT GLPI=0.78.1
GLPI-PROJECT GLPI=0.78.2
GLPI-PROJECT GLPI=0.78.3
GLPI-PROJECT GLPI=0.78.4
GLPI-PROJECT GLPI=0.78.5
GLPI-PROJECT GLPI=0.80
GLPI-PROJECT GLPI=0.80.1
GLPI-PROJECT GLPI=0.80.2
GLPI-PROJECT GLPI=0.80.3
GLPI-PROJECT GLPI=0.80.4
GLPI-PROJECT GLPI=0.80.5
GLPI-PROJECT GLPI=0.80.6
GLPI-PROJECT GLPI=0.80.61
Event History
Jul 12, 2012
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-1037?
CVE-2012-1037 is considered a critical vulnerability due to its ability to allow remote authenticated users to execute arbitrary PHP code.
2
How do I fix CVE-2012-1037?
To fix CVE-2012-1037, upgrade GLPI to version 0.80.62 or later where the vulnerability has been patched.
3
What versions of GLPI are affected by CVE-2012-1037?
CVE-2012-1037 affects GLPI versions 0.78 through 0.80.61.
4
Who can exploit the vulnerability identified by CVE-2012-1037?
CVE-2012-1037 can be exploited by remote authenticated users who have the ability to provide malicious input.
5
Is there a workaround for CVE-2012-1037 while waiting for a patch?
There is no specific workaround for CVE-2012-1037, so it is strongly recommended to apply the patch by upgrading GLPI.