CVE-2013-2226: SQL Injection
Multiple SQL injection vulnerabilities in GLPI before 0.83.9 allow remote attackers to execute arbitrary SQL commands via the (1) usersidassign parameter to ajax/ticketassigninformation.php, (2) filename parameter to front/document.form.php, or (3) table parameter to ajax/comments.php.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2226?
The severity of CVE-2013-2226 is considered high due to multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands.
How do I fix CVE-2013-2226?
To fix CVE-2013-2226, upgrade GLPI to version 0.83.9 or later where the vulnerabilities have been addressed.
Which versions of GLPI are affected by CVE-2013-2226?
CVE-2013-2226 affects GLPI versions prior to 0.83.9, including 0.83.8 and all previous 0.83.x versions.
What are the specific vulnerable parameters in CVE-2013-2226?
The specific vulnerable parameters in CVE-2013-2226 include users_id_assign, filename, and table.
Can exploitation of CVE-2013-2226 lead to data leakage?
Yes, successful exploitation of CVE-2013-2226 can lead to unauthorized access and potential data leakage from the database.