CVE-2017-11329

Critical

Published: 17/07/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

GLPI versions before 9.1.5 are vulnerable to SQL injection via an ajax/getDropdownValue.php request with an entity_restrict parameter that is not a list of integers.

Risk Assessment

An attacker could exploit this vulnerability to execute unauthorized queries against the database, potentially leading to the disclosure of sensitive information or data manipulation.

Recommendation

It is recommended to upgrade GLPI to version 9.1.5 or later to mitigate this vulnerability.

Original NVD description (English source)

GLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an entity_restrict parameter that is not a list of integers.