[9.2.2] SQL injection in front/computer.php CVE-2018-13049

[AceSec]

• Steps to reproduce (which actions have you made) :
  login in the glpi and make the reques http://url/glpi2/front/computer.php with the poc
  I sended the detail of the vulnerability to glpi-security@ow2.org

• Expected result :

you can find the result in the sql-error.log

• Actual result :
  the same with the Expected result

• URL of the page :
  http://url/glpi2/front/computer.php

• Screenshot of the problem (if pertinent) :

• Your GLPI setup (you can find it in Setup > General menu, System tab) :

you can find it in asset >computer

[trasher]

In the future, please do not open public tickets for security issues, just send the mail to glpi-security. Thank you.

[AceSec]

ok

[AceSec]

Exploit Author: Ji.xu From DBAppSecurity
CVE: CVE-2018-13049