CVE-2013-5696

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2013-09-23 · updated 2026-06-16
Weakness: CWE-352

Description

inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and (1) perform a SQL injection via an Etape_4 action or (2) execute arbitrary PHP code via an update_1 action.

Affected products

glpi-project glpi: through 0.84.1; 0.5, 0.5-rc1, 0.5-rc2, 0.6, 0.6-rc1, 0.6-rc2 (+72)

References

http://www.glpi-project.org/spip.php?page=annonce&id_breve=308
https://forge.indepnet.net/issues/4480
https://forge.indepnet.net/projects/glpi/repository/revisions/21753
https://forge.indepnet.net/projects/glpi/repository/revisions/21753/diff/branches/0.84-bugfixes/inc/central.class.php
https://www.navixia.com/blog/entry/navixia-finds-critical-vulnerabilities-in-glpi-cve-2013-5696.html
http://www.glpi-project.org/spip.php?page=annonce&id_breve=308
https://forge.indepnet.net/issues/4480
https://forge.indepnet.net/projects/glpi/repository/revisions/21753
https://forge.indepnet.net/projects/glpi/repository/revisions/21753/diff/branches/0.84-bugfixes/inc/central.class.php
https://www.navixia.com/blog/entry/navixia-finds-critical-vulnerabilities-in-glpi-cve-2013-5696.html

Get alerted when CVE-2013-5696 or the next vulnerability affects your stack