Description
In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an attacker without a valid account by using a CSRF. Due to the difficulty of the exploitation, the attack is only conceivable by an account having Maintenance privileges and the right to add WIFI networks. This is fixed in version 9.4.6.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| glpi-project | GLPI | < 9.4.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | glpi | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 2
- GLPI GZIP(Py3) 9.4.5 - RCE EDB-51726 · webapps · Oct 9, 2023
- GLPI 9.4.5 - Remote Code Execution (RCE) EDB-49992 · webapps · Jun 14, 2021
GitHub 1 repository
-
0xdreadnaught/cve-2020-11060-poc ★ 8 · Jun 11, 2021
Python3 POC for CVE 2020-11060
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.