SQL Injection in GLPI

High-Tech Bridge Security Research Lab discovered a high-risk SQL injection vulnerability in a popular Information Resource Manager (IRM) system GLPI. IRM systems are usually used for management and audit of software packages, providing ITIL-compliant service desk. The vulnerability allows remote non-authenticated attacker to execute arbitrary SQL queries, read and write data to the application's database and completely compromise the vulnerable system.

The vulnerability exists due to insufficient filtration of user-supplied data passed via the "page_limit" HTTP GET parameter to "/ajax/getDropdownConnect.php" PHP script. A remote unauthenticated attacker can alter present SQL query, inject and execute arbitrary SQL command in application's database.

Below is a simple SQL Injection exploit, which uses time-based exploitation technique. The page will load time will be significantly higher if MySQL version is 5.X or superior:

http://[host]/ajax/getDropdownConnect.php?fromtype=Computer&itemtype=Compute r&page=1&page_limit=1%20PROCEDURE%20analyse%28%28select%20extractvalue%28ran d%28%29,concat%280x3a,%28IF%28MID%28version%28%29,1,1%29%20LIKE%205,%20BENCH MARK%285000000,SHA1%281%29%29,1%29%29%29%29%29,1%29