bugtraq - [PT-2011-23] Database information disclosure in GLPI

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201108220519.p7M5JRtU015797@sf01web3.securityfocus.com>
Date: Mon, 22 Aug 2011 05:19:27 GMT
From: noreply@...ecurity.ru
To: bugtraq@...urityfocus.com
Subject: [PT-2011-23] Database information disclosure in GLPI

----------------------------------------------------------------------

     (PT-2011-23) Positive Technologies Security Advisory 

             Database information disclosure in GLPI

----------------------------------------------------------------------

---[ Vulnerable software ]

                GLPI 
		Version 0.80.1 and earlier

                Application link:	
		http://www.glpi-project.org/

---[ Severity level ]

                Severity level:                High
                Impact:                        Database information disclosure
                Access Vector:                 Network exploitable

	       CVSS v2:
        	       Base Score:     6.5
	               Vector:         (AV:N/AC:L/Au:S/C:P/I:P/A:P)

                CVE:   not assigned

---[ Software description ]

GLPI is a powerful enterprise ready-to-use suite that allows you to "build your own system" on the fly. It includes a help desk, a knowledge base, a time manager and a reporting system supported by highly configurable and extensible Action & Information Management System. 

---[ Vulnerability description ]

Positive Research Center has discovered a database information disclosure vulnerability in GLPI.
The vulnerability can be exploited with a minimally privileged user account such as "post-only."
The vulnerable script is /ajax/autocompletion.php. An authorized user can send a special request to this script and get all
usernames registered in the system along with their password hashes.

--[ How to fix ]

Update your software up to the latest version 

---[ Credits ]

These vulnerabilities were detected by Yuri Goltsev, Positive Research Center (Positive Technologies Company)