You are not logged in.
- Topics: Active | Unanswered
Announcement
Download last stable version of GLPI - What can you do for GLPI ? : Contribute
Pages: 1
Topic closed
#1 2009-01-23 13:24:39
- zigma
- Member
- Registered: 2009-01-23
- Posts: 3
Plusieurs SQL injections au GLPi v 0.71.3
[+] Application : GLPI v 0.71.3
[+] App'z URI : http://
[+] Bug : Multiple Remote SQL Injections
[+] Description :
[+] Author : Null Area Security
Zigma
[+] Home : www.NullArea.Net
CUT
Explications étudiées par l'équipe de développement.
Offline
#2 2009-01-23 16:03:12
- MoYo
- GLPI - Lead
- From: Poitiers
- Registered: 2004-09-13
- Posts: 14,513
- Website
Re: Plusieurs SQL injections au GLPi v 0.71.3
Thanks for your return.
In fact all request arguments need to be quote protected like this :
field='$cond';
As you said writting : field=$cond make slashes protection useless.
We will try to correct it as soon as possible.
MoYo - Julien Dombre - Association INDEPNET
Contribute to GLPI : Support Contribute References Freshmeat
Offline
#3 2009-01-23 16:03:25
- JMD
- GLPI - Lead
- Registered: 2004-09-13
- Posts: 9,180
- Website
Re: Plusieurs SQL injections au GLPi v 0.71.3
Merci du retour.
En déplacement pro là, pas évident de regarder en détail votre signalement.
On s'y attèle en urgence.
Par contre il aurait été nettement préférable de nous contacter en direct pour ce genre de remontés
JMD / Jean-Mathieu Doléans - Glpi-project.org - Association Indepnet
Apportez votre pierre au projet GLPI : Soutenir
Offline
#4 2009-01-24 10:47:06
- zigma
- Member
- Registered: 2009-01-23
- Posts: 3
Re: Plusieurs SQL injections au GLPi v 0.71.3
dsl pour poster l'exploit ici , j'ai pas vu le Bugtrack 
, and it would be really nice to indicate the next release ( in here or by Email which is indicated in the PoC) so I can publish the exploit 
Last edited by zigma (2009-01-24 10:48:31)
Offline
#6 2009-01-26 00:25:59
- JMD
- GLPI - Lead
- Registered: 2004-09-13
- Posts: 9,180
- Website
Re: Plusieurs SQL injections au GLPi v 0.71.3
The next release is available : http://www.glpi-project.org/forum/viewt … p?id=13358
JMD / Jean-Mathieu Doléans - Glpi-project.org - Association Indepnet
Apportez votre pierre au projet GLPI : Soutenir
Offline
#7 2009-01-26 07:49:02
- remi
- GLPI-DEV
- From: Champagne
- Registered: 2007-04-28
- Posts: 7,127
- Website
Re: Plusieurs SQL injections au GLPi v 0.71.3
Please, wait a few days before publishing your exploit.
The time for distribution mainteners to update their packages.
Remi.
Dév. Fedora 29 - PHP 5.6/7.0/7.1/7.2/7.3/7.4 - MariaDB 10.3 - GLPI master
Certifié ITILv3 - RPM pour Fedora, RHEL et CentOS sur https://blog.remirepo.net/
Offline
#8 2009-01-26 17:15:22
- zigma
- Member
- Registered: 2009-01-23
- Posts: 3
Re: Plusieurs SQL injections au GLPi v 0.71.3
@Remi : Yes of course , and I would love to say Congratulations for the fast work
Offline
#9 2009-01-26 20:44:10
- MoYo
- GLPI - Lead
- From: Poitiers
- Registered: 2004-09-13
- Posts: 14,513
- Website
Re: Plusieurs SQL injections au GLPi v 0.71.3
je ferme
MoYo - Julien Dombre - Association INDEPNET
Contribute to GLPI : Support Contribute References Freshmeat
Offline
Pages: 1
Topic closed