medium6.4Public exploit code
CVE-2013-2225
inc/ticket.class.php in GLPI 0.83.9 and earlier allows remote attackers to unserialize arbitrary PHP objects via the _predefined_fields parameter to front/tick…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- GLPI 0.83.9 - 'Unserialize()' Remote Code Execution2013-07-01 · webapps · php
Impact
inc/ticket.class.php in GLPI 0.83.9 and earlier allows remote attackers to unserialize arbitrary PHP objects via the _predefined_fields parameter to front/ticket.form.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Glpi-Project | Glpi | through 0.83.9 Versions 0.5, 0.6, 0.20, 0.21, 0.30 |
References
- NVD record
- CVE.org record
- http://osvdb.org/94683
- http://seclists.org/oss-sec/2013/q2/626
- http://seclists.org/oss-sec/2013/q2/645
- http://www.exploit-db.com/exploits/26530
- http://www.securityfocus.com/bid/60823
- https://forge.indepnet.net/projects/glpi/repository/revisions/21169/diff
- http://osvdb.org/94683
- http://seclists.org/oss-sec/2013/q2/626
- http://seclists.org/oss-sec/2013/q2/645
- http://www.exploit-db.com/exploits/26530
- http://www.securityfocus.com/bid/60823
- https://forge.indepnet.net/projects/glpi/repository/revisions/21169/diff