CVE-2023-41320: Account takeover via SQL Injection in UI layout preferences in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. UI layout preferences management can be hijacked to lead to SQL injection. This injection can be use to takeover an administrator account. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is GLPI?
GLPI stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking, and software auditing.
What is the vulnerability in GLPI?
The vulnerability in GLPI is a SQL injection that can be exploited through the hijacking of UI layout preferences management.
How severe is CVE-2023-41320?
CVE-2023-41320 has a severity score of 9.8, which is considered critical.
How can the SQL injection vulnerability be exploited?
The SQL injection vulnerability can be exploited by manipulating the UI layout preferences management, leading to unauthorized access and potential data breaches.
How can I fix the SQL injection vulnerability in GLPI?
To fix the SQL injection vulnerability in GLPI, it is recommended to update to version 10.0.11 or later as provided by the GLPI project.