CVE-2022-31061 (published 2022-06-28T18:15Z)

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions there is a SQL injection vulnerability which is possible on login page. No user credentials are required to exploit this vulnerability. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/glpi-project/glpi
commit_details: repo_url: https://github.com/glpi-project/glpi
author: Johan Cwiklinski
author_date: 2022-06-28 12:19:52+02:00
msg: Merge pull request from GHSA-w2gc-v2gm-q7wq
repository: repo_url: https://github.com/glpi-project/glpi
repo_name: glpi-project/glpi
description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.
repo_language: PHP
owner: glpi-project
file_changes: filename: Auth.php
change_type: ModificationType.MODIFY
diff: @@ -736,19 +736,16 @@ class Auth extends CommonGLPI
         if ($login_auth == 'local') {
             $authtype = self::DB_GLPI;
             $this->user->fields["authtype"] = self::DB_GLPI;
-        } else if (strstr($login_auth, '-')) {
-            $auths = explode('-', $login_auth);
-            $this->user->fields["auths_id"] = $auths[1];
-            if ($auths[0] == 'ldap') {
+        } else if (preg_match('/^(?<type>ldap|mail|external)-(?<id>\d+)$/', $login_auth, $auth_matches)) {
+            $this->user->fields["auths_id"] = (int)$auth_matches['id'];
+            if ($auth_matches['type'] == 'ldap') {
                 $authtype = self::LDAP;
-                $this->user->fields["authtype"] = self::LDAP;
-            } else if ($auths[0] == 'mail') {
+            } else if ($auth_matches['type'] == 'mail') {
                 $authtype = self::MAIL;
-                $this->user->fields["authtype"] = self::MAIL;
-            } else if ($auths[0] == 'external') {
+            } else if ($auth_matches['type'] == 'external') {
                 $authtype = self::EXTERNAL;
-                $this->user->fields["authtype"] = self::EXTERNAL;
             }
+            $this->user->fields['authtype'] = $authtype;
         }
         if (!$noauto && ($authtype = self::checkAlternateAuthSystems())) {
             if (

programming_language: PHP