Staging Environment: Content and features may be unstable or change without notice.
Advisory details: ubuntu_osv / UBUNTU-CVE-2014-9258
Advisory ID ubuntu_osv/UBUNTU-CVE-2014-9258
Aliases CVE-2014-9258
Summary SQL injection vulnerability in ajax/getDropdownValue.php in GLPI before 0.85.1 allows remote authenticated users to execute arbitrary SQL commands via the condition parameter.
Status Published
Exploitability 2.0
Weighted Severity 6.2
Risk 10.0
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
ubuntu-priority medium https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2014/UBUNTU-CVE-2014-9258.json
Reference id Reference type URL
http://osvdb.org/show/osvdb/115957
http://secunia.com/advisories/61367
http://security.szurek.pl/glpi-085-blind-sql-injection.html
https://ubuntu.com/security/CVE-2014-9258
https://www.cve.org/CVERecord?id=CVE-2014-9258
http://www.exploit-db.com/exploits/35528
http://www.glpi-project.org/spip.php?page=annonce&id_breve=334&lang=en
Data source Exploit-DB
Date added Dec. 15, 2014
Description GLPI 0.85 - Blind SQL Injection
Ransomware campaign use Unknown
Source publication date Dec. 15, 2014
Exploit type webapps
Platform php
Source update date Dec. 15, 2014

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.