critical9.8
CVE-2019-12723
An issue was discovered in the Teclib Fields plugin through 1.9.2 for GLPI.
Impact
An issue was discovered in the Teclib Fields plugin through 1.9.2 for GLPI. it allows SQL Injection via container_id and old_order parameters to ajax/reorder.php by an unauthenticated user.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Teclib-Edition | Fields | through 1.9.2 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/pluginsGLPI/fields/blob/master/ajax/reorder.php
- https://github.com/pluginsGLPI/fields/pull/317
- https://github.com/pluginsGLPI/fields/releases/tag/1.10.0
- https://github.com/pluginsGLPI/fields/blob/master/ajax/reorder.php
- https://github.com/pluginsGLPI/fields/pull/317
- https://github.com/pluginsGLPI/fields/releases/tag/1.10.0