CVE-2020-15175

published 2020-10-07

CVE-2020-15175: In GLPI before version 9.5.2, the `​pluginimage.send.php​` endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted…

Priority P2 68 critical 9.1 CVSS 3.1

AV N AC L PR N UI N S U C H I H A N

In GLPI before version 9.5.2, the `​pluginimage.send.php​` endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the files and folders contained in “/files/”. Some of the sensitive information that is compromised are the user sessions, logs, and more. An attacker would be able to get the Administrators session token and use that to authenticate. The issue is patched in version 9.5.2.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
glpi-project	glpi	< 9.5.2	9.5.2

Detection & IOCs extracted from sources · hover to see the quote

path /front/pluginimage.send.php↗

filename .htaccess↗

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS GLPI Unauthenticated File Deletion (CVE-2020-15175)"; flow:established,to_server; http.uri; content:"/front/pluginimage.send.php|3f|"; fast_pattern; content:"plugin|3d|"; content:"name|3d|"; content:"clean"; reference:url,github.com/Orange-Cyberdefense/glpwnme; reference:cve,2020-15175; classtype:web-application-attack; sid:2067152; rev:1; metadata:affected_product GLPI, attack_target Server, tls_state TLSEncrypt, created_at 2026_01_28, cve CVE_2020_15175, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag Exploit, updated_at 2026_01_28, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

• → Monitor HTTP requests to /front/pluginimage.send.php containing the query parameters 'plugin=', 'name=', and the string 'clean', which is the pattern used to trigger malicious .htaccess deletion.
• → Watch for unauthorized access to /files/ directory contents (session files, logs) following exploitation, which may indicate an attacker harvesting administrator session tokens for lateral movement. ↗

• · The exploit is unauthenticated — no valid session or credentials are required to trigger the .htaccess deletion via the pluginimage.send.php endpoint.
• · The Snort/Suricata rule (sid:2067152) includes deployment metadata for both plaintext (Perimeter, Internal) and TLS-decrypted traffic (SSLDecrypt, TLSEncrypt), meaning detection requires SSL inspection for encrypted traffic.
• · The vulnerability is patched in GLPI version 9.5.2; all versions prior to 9.5.2 are affected. ↗

CVSS provenance

nvd v3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

nvd v2.0 6.4 MEDIUM AV:N/AC:L/Au:N/C:P/I:P/A:N

osv 9.1 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-552