Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from users that are allowed to create dropdowns. This issue has been patched in version 1.23.3.
The vulnerability results from insufficient input data validation (CWE-20) during the creation of dropdown type elements in the Fields plugin. A user with permissions to create dropdowns can provide crafted data, which is executed as PHP code on the server side. No user interaction is required nor particularly low privileges — access to dropdown management functionality is sufficient.
An attacker can execute arbitrary PHP code on the server, which in practice means complete system takeover — data reading and modification, backdoor installation, and lateral movement in the network.
The Fields plugin should be updated to version 1.23.3, in which the vulnerability has been fixed. The patch is available in the manufacturer's GitHub repository: https://github.com/pluginsGLPI/fields/releases/tag/1.23.3
Fields plugin for GLPI (Teclib-Edition) in versions prior to 1.23.3.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HTeclib Edition Fields
APPTeclib-Edition< 1.23.3
Related vulnerabilities
SQL Injection w Teclib Fields plugin dla GLPI — dostęp bez uwierzytelnienia
Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 a...
RCE w pluginie GLPI Addressing — command injection po uwierzytelnieniu
SQL injection w GLPI via parametr 'cycle' w skrypcie unlock_tasks.php
Pominięcie uwierzytelnienia w GLPI przez PHP type juggling