.. / CVE-2019-10232

• SQLi
• Nuclei
• Web

Exploit for Teclib GLPI <= 9.3.3 - Unauthenticated SQL Injection (CVE-2019-10232)

Description:

Teclib GLPI <= 9.3.3 exposes a script (/scripts/unlock_tasks.php) that incorrectly sanitizes user controlled data before using it in SQL queries. Thus, an attacker could abuse the affected feature to alter the semantic original SQL query and retrieve database records.

Nuclei Template

View the template here CVE-2019-10232.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2019/CVE-2019-10232.yaml

References: