CVE-2020-15176: 
GLPI vulnerability analysis and mitigation

CVE-2020-15176 is a SQL injection vulnerability discovered in GLPI (IT Asset Management Software) affecting versions prior to 9.5.2. The vulnerability was disclosed on October 7, 2020, and stems from improper handling of back tick characters in SQL queries. When supplying a back tick in input that gets put into a SQL query, the application does not properly escape or sanitize the input (GHSA Advisory).

The vulnerability exists in the SQL query handling mechanism where the isNameQuoted() function incorrectly processes input containing back tick characters. This allows malicious actors to inject arbitrary SQL commands into queries. The issue was fixed by removing the ability to use SQL expressions as string in criterion values and replacing it with the usage of QueryExpression (GLPI Commit).

The vulnerability allows attackers to perform SQL injection attacks that could lead to unauthorized access to sensitive information stored in the GLPI database, including passwords, reset tokens, and personal details. The severity of this vulnerability is rated as High due to its potential for data exfiltration (GHSA Advisory).

The vulnerability can be exploited by supplying specially crafted input containing back tick characters that get incorporated into SQL queries. The attack vector requires the ability to input data that reaches the SQL query processing components of the application (GHSA Advisory).

The recommended mitigation is to upgrade to GLPI version 9.5.2 or later, which includes the security fix. The patch removes the ability to use SQL expressions as string in criterion values and implements proper input sanitization using QueryExpression (GLPI Commit).