CVE-2020-5248 — CVE-2020-5248 | Kitploit

CVE-2020-5248 POC Environment Setup and Test

Test Method

Environment Setup

vim docker/nginx/default.conf
server_name [docker host ip ];  -change
mysqlserver: mysql  id: root pw: root

Run

cd docker/app/
tar -xvf /docker/app/glpi-9.4.5.tgz
chmod -R 777 glpi
docker-compose up -d

Access glpi at http://localhost:8080/glpi

POC Test
poc : https://github.com/indevi0us/CVE-2020-5248
Test : https://offsec.almond.consulting/multiple-vulnerabilities-in-glpi.html
Obtain ciphertext - http://localhost:8080/glpi

docker/poc/decrypt_any.php
vim decrpyt_any.php - change - decrypt ("decrytion")
http://localhost:8080/poc/decrypt_any.php

Note

If installation fails, delete glpi and redo the tar operation.