Critical · published November 2, 2023
🔥 An unverified object instantiation in GLPI could let attackers upload malicious PHP files without breaking a sweat! Think of it as a delivery service accepting packages without checking the contents—if someone slips in a dangerous item, it could wreak havoc. This vulnerability essentially allows bad actors to drop off harmful PHP files right where they can be executed! If exploited, an attacker could execute arbitrary PHP scripts on your server, potentially leading to total system takeover, data breaches, or even more devastating consequences. It's like handing the keys to your entire IT management system over to a stranger!
Think of it as a delivery service accepting packages without checking the contents—if someone slips in a dangerous item, it could wreak havoc. This vulnerability essentially allows bad actors to drop off harmful PHP files right where they can be executed! Starting from version 10.0.7 and prior to 10.0.10, GLPI fails to verify object instantiation, allowing unauthorized file uploads to sensitive directories. Depending on server settings, these PHP files can be executed directly via web requests.
If exploited, an attacker could execute arbitrary PHP scripts on your server, potentially leading to total system takeover, data breaches, or even more devastating consequences. It's like handing the keys to your entire IT management system over to a stranger! Immediately upgrade GLPI to version 10.0.10 to fix this critical issue. As a temporary workaround, remove write access for the web server on the `/ajax` and `/front` directories to prevent any unauthorized file uploads. Don’t let this linger! You've got this! Follow these steps, and you’ll have your GLPI environment secured in no time! 🛡️