| Package | Affected versions | Patched versions |
|---|---|---|
| glpi | = 0.20= 0.21= 0.30= 0.31= 0.40= 0.41= 0.42= 0.5= 0.51= 0.51a= 0.6= 0.65= 0.68= 0.68.1= 0.68.2= 0.68.3= 0.70= 0.70.1= 0.70.2= 0.71= 0.71.1= 0.71.2= 0.71.3= 0.71.4= 0.71.5= 0.71.6= 0.72= 0.72.1= 0.72.2= 0.72.3= 0.72.4= 0.78= 0.78.1= 0.78.2= 0.78.3= 0.78.4= 0.78.5= 0.80= 0.80.1= 0.80.2= 0.80.3= 0.80.4= 0.80.5= 0.80.6= 0.80.61= 0.80.7= 0.83= 0.83.1= 0.83.2= 0.83.3= 0.83.31= 0.83.4= 0.83.5= 0.83.6= 0.83.7= 0.83.8= 0.83.9= 0.83.91= 0.84≤ 0.84.1 |
inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and (1) perform a SQL injection via an Etape_4 action or (2) execute arbitrary PHP code via an update_1 action.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free