CVE:CVE-2012-1037
CNNVD:CNNVD-201202-211
GLPI是Indepnet协会维护的一款开源的IT资源管理套件。该套件包含设备状态管理、资产清单存储、管理流程和工作日志管理等功能。
GLPI 0.78至0.80.61之间的版本中存在PHP远程文件包含漏洞，该漏洞源于对用户提供的输入未经充分过滤。攻击者可利用该漏洞在受影响应用程序上下文中包含并执行任意远程文件和恶意PHP代码，这将有助于操控应用程序和底层系统，也可能执行其他攻击。
solution:Upgrade glpi-project glpi to a higher version than 0.78,0.78.1,0.78.2,0.78.3,0.78.4,0.78.5,0.80,0.80.1,0.80.2,0.80.3,0.80.4,0.80.5,0.80.6,0.80.61,and avoid the version 0.78,0.78.1,0.78.2,0.78.3,0.78.4,0.78.5,0.80,0.80.1,0.80.2,0.80.3,0.80.4,0.80.5,0.80.6,0.80.61