CVE-2021-21324: 
GLPI vulnerability analysis and mitigation

CVE-2021-21324 is an Insecure Direct Object Reference (IDOR) vulnerability discovered in GLPI's Solutions feature. The vulnerability was disclosed on March 2, 2021, and affects GLPI versions prior to 9.5.4. The issue allows authenticated users to enumerate GLPI items names, including user logins, through the knowbase search form (GHSA Advisory).

The vulnerability exists in the knowbase search functionality where an authenticated attacker can manipulate the item_itemtype and item_items_id parameters in URLs like '/glpi/front/knowbaseitem.php?item_itemtype=Ticket&item_items_id=18&forcetab=Knowbase$1'. By changing these parameters, attackers can access information from different database tables, including user data. The vulnerability leverages incremental IDs to enumerate system information (GHSA Advisory).

The vulnerability allows authenticated attackers to enumerate GLPI items names, including sensitive information such as user logins. Since the IDs are incremental, attackers can systematically access information through guessing-based attempts (GHSA Advisory).

The vulnerability requires authentication and can be exploited by manipulating URL parameters in the knowbase search functionality. The exploitation process involves changing the item_itemtype parameter to target different database tables and modifying item_items_id to access different records (GHSA Advisory).

The vulnerability was fixed in GLPI version 9.5.4. Organizations should upgrade to this version or later to address the security issue. The fix was released as part of a security update that addressed multiple vulnerabilities (GLPI Release).