cve/cves/2013/CVE-2013-5696.md

CVE-2013-5696

Description

inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and (1) perform a SQL injection via an Etape_4 action or (2) execute arbitrary PHP code via an update_1 action.

POC

Reference

No PoCs from references.

Github

No PoCs found on GitHub currently.

ExploitDB

• https://www.exploit-db.com/exploits/28685
• https://www.exploit-db.com/exploits/28483

Metasploit

• https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/glpi_install_rce.rb