CVE-2013-2227

published 2019-11-01

CVE-2013-2227: GLPI 0.83.7 has Local File Inclusion in common.tabs.php.

Priority P3 57 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

GLPI 0.83.7 has Local File Inclusion in common.tabs.php.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
glpi-project	glpi	—	—
glpi-project	glpi	>= 0 < 0.84.3+dfsg.1-1	0.84.3+dfsg.1-1
indepnet_development_team	glpi	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /glpi/ajax/common.tabs.php↗

path ../../../../../../../../../../../../../../../../etc/passwd%00User↗

• → Detect LFI attempts against GLPI's common.tabs.php via the 'itemtype' POST parameter containing directory traversal sequences and null byte (%00) encoding. ↗
• → Monitor POST requests to /glpi/ajax/ticketassigninformation.php for SQL injection payloads in the 'users_id_assign' parameter (e.g., trailing single-quote or SQL syntax). ↗
• → Monitor POST requests to /glpi/front/document.form.php for SQL injection payloads in the multipart 'filename' field. ↗
• → Monitor POST requests to /glpi/ajax/comments.php for SQL injection payloads in the 'table' parameter. ↗
• → The LFI vulnerability is triggered via the 'itemtype' parameter in /ajax/common.tabs.php, which is passed directly to a PHP object instantiation without sanitisation. ↗
• → Successful LFI exploitation results in local file disclosure; watch for /etc/passwd content in HTTP responses from GLPI endpoints. ↗

• · The LFI vulnerability requires null-byte injection (%00) to truncate the appended string, which is only effective on PHP versions where null-byte truncation in file paths is possible (typically PHP < 5.3.4). ↗

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

osv 7.5 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20