In this post I will describe how I found a patch bypass to re-exploit a SQL injection vulnerability, along with how to take it further to achieve RCE on a vulnerable GLPI instance.
P.S.
+ Example of a GLPI web shell for accessing hidden variables and credentials, which can be useful when GLPI is connected to Active Directory via LDAP. This can help gather credentials of privileged users. While GLPI encrypts these credentials in the database, a web shell can access, decrypt, and display them.