Critical · published September 14, 2022
🚨 A sneaky SQL injection flaw in GLPI could let attackers log in as ANY user with just a crafty request — talk about an unexpected guest at the IT party! 🔥 Think of it like a hotel where anyone can walk in and claim they belong, bypassing check-in entirely. Without the right verification, any attacker can slip past the front desk and access all the amenities! This vulnerability could allow an attacker to simulate an arbitrary user login, gaining access to sensitive information and control over IT assets. Imagine the chaos if someone could impersonate a privileged user — they could change settings, access confidential data, or even lock out legitimate users!
Think of it like a hotel where anyone can walk in and claim they belong, bypassing check-in entirely. Without the right verification, any attacker can slip past the front desk and access all the amenities! CVE-2022-35947 is a SQL injection vulnerability in GLPI that allows attackers to craft a malicious login request, exploiting the system's trust in its authentication process. This issue affects versions prior to 10.0.3, meaning if you're still on an older version, you're at risk!
This vulnerability could allow an attacker to simulate an arbitrary user login, gaining access to sensitive information and control over IT assets. Imagine the chaos if someone could impersonate a privileged user — they could change settings, access confidential data, or even lock out legitimate users! To protect yourself, upgrade to version 10.0.3 immediately. If you can't upgrade right away, ensure you disable the `Enable login with external token` API configuration to minimize risks while you get things sorted out! You've got this! With these steps, you can safeguard your GLPI installation and keep your IT environment secure! 🛡️