TGViewer
APT APT @apt_notes · 16.6K subscribers
Post #1092 4.49K

Forwarded from 1N73LL1G3NC3

🍊From a GLPI patch bypass to RCE (by Orange Cyberdefense's SensePost Team)

In this post I will describe how I found a patch bypass to re-exploit a SQL injection vulnerability, along with how to take it further to achieve RCE on a vulnerable GLPI instance.

P.S.
+ Example of a GLPI web shell for accessing hidden variables and credentials, which can be useful when GLPI is connected to Active Directory via LDAP. This can help gather credentials of privileged users. While GLPI encrypts these credentials in the database, a web shell can access, decrypt, and display them.
  • 🔥 10
  • 👍 1
More from @apt_notes
  1. Sep 1, 2026🔒 Certi-Bhai — IIS AppPool → NT AUTHORITY\SYSTEM via AD CS RPC A webshell under IIS AppPo…
  2. Aug 17, 2026🔒 Citrix NetScaler Pre-Auth RCE (CVE-2026-8452) Unauthenticated heap overflow in SAML sig…
  3. Aug 11, 2026Post #1201
  4. Aug 7, 2026ResetNightmare ResetNightmare (CVE-2026-27912) is a validation flaw in the Kerberos Change…
  5. Jul 24, 2026🔒 Certighost (CVE-2026-54121) — AD CS Domain Controller Impersonation Low-privileged doma…
  6. Jul 9, 2026💉 P³ — Shellcode Loader: Process Parameter Poisoning This loader implements a code inject…
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →