CVE-2022-34128

The Cartography (aka positions) plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

7.81% chance of exploitation in the next 30 days, 95th percentile

Published

2023-04-16

Updated

2025-02-06

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/51234

Security advisories

• InfotelGLPI/positions/releases/tag/6.0.1
• InfotelGLPI/positions/security/advisories/GHSA-947x-g9g9-rcmx
• https://pentest.blog/advisory-glpi-service-management-software-sql-injection-remote-code-…

References

• CVE Record
• NVD entry