CVE:CVE-2013-2226
CNNVD:CNNVD-201306-447
GLPI是Indepnet协会维护的一款开源的IT资源管理套件。该套件包含设备状态管理、资产清单存储、管理流程和工作日志管理等功能。
GLPI 0.83.8及之前的版本存在SQL注入漏洞，该漏洞源于ajax/ticketassigninformation.php脚本没有充分过滤‘users_id_assign’参数；front/document.form.php脚本没有充分过滤‘filename’参数；ajax/comments.php脚本没有充分过滤‘table’参数。远程攻击者可利用该漏洞执行任意SQL命令。
solution:Upgrade glpi-project glpi to a higher version than 0.83.8,0.83,0.83.1,0.83.2,0.83.3,0.83.4,0.83.5,0.83.6,0.83.7,0.83.31,and avoid the version (,0.83.8],0.83,0.83.1,0.83.2,0.83.3,0.83.4,0.83.5,0.83.6,0.83.7,0.83.31