CVE-2019-12723 | BDVDB-2026-118992 Detail

Description#

An issue was discovered in the Teclib Fields plugin through 1.9.2 for GLPI. it allows SQL Injection via container_id and old_order parameters to ajax/reorder.php by an unauthenticated user.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/pluginsGLPI/fields/blob/master/ajax/reorder.php
https://github.com/pluginsGLPI/fields/pull/317
https://github.com/pluginsGLPI/fields/releases/tag/1.10.0

Exploit#

No public exploit known

History#

Version 12019-07-10Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.