CVE-2013-5696: SQL Injection
inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and (1) perform a SQL injection via an Etape4 action or (2) execute arbitrary PHP code via an update1 action.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-5696?
The severity of CVE-2013-5696 is typically classified as medium due to its potential impact through CSRF and SQL injection vulnerabilities.
What types of attacks can CVE-2013-5696 facilitate?
CVE-2013-5696 can facilitate cross-site request forgery (CSRF) attacks and SQL injection via specific actions.
How do I fix CVE-2013-5696?
To fix CVE-2013-5696, upgrade GLPI to version 0.84.2 or later, which mitigates the vulnerability.
What software versions are affected by CVE-2013-5696?
CVE-2013-5696 affects GLPI versions prior to 0.84.2, including versions 0.5 through 0.83.9.
Can CVE-2013-5696 impact data integrity?
Yes, CVE-2013-5696 can impact data integrity through SQL injection, allowing unauthorized data manipulation.