Order GLPI plugin vulnerable to remote code execution from authenticated user
CVE-2023-29006
8.8HIGH
What is CVE-2023-29006?
The Order GLPI plugin enables order management within GLPI. However, versions 1.8.0 through 2.7.6 are susceptible to a command injection vulnerability. Authenticated users with access to the standard interface can manipulate a crafted URL to execute arbitrary system commands. This security flaw has been addressed in versions 2.7.7 and 2.10.1. For immediate mitigation, it is recommended to remove the vulnerable ajax/dropdownContact.php file from the plugin directory.
Affected Version(s)
order >= 1.8.0, < 2.7.7 < 1.8.0, 2.7.7
order >= 2.10.0, < 2.10.1 < 2.10.0, 2.10.1