---
id: 4382
title: "Exploiting GLPI during a Red Team engagement"
source_domain: blog.quarkslab.com
source_url: "https://blog.quarkslab.com/exploiting-glpi-during-a-red-team-engagement.html"
published_at: "2024-03-20T23:00:00Z"
tags: ["php", "sql-injection", "red-team", "ssrf", "glpi", "cve-2024-27096"]
phying_url: "https://phying.com/item/4382"
lang: en
---

# Exploiting GLPI during a Red Team engagement

## Summary

During a Red Team engagement, Quarkslab developed a 1-day for GLPI CVE-2023-43813, then found an arbitrary object instantiation leading to SSRF (CVE-2024-27098) and a SQL injection (CVE-2024-27096).

## Intelligence Metadata

- **Sources:** blog.quarkslab.com
- **Published:** 2024-03-20T23:00:00Z
- **Original:** https://blog.quarkslab.com/exploiting-glpi-during-a-red-team-engagement.html
- **Phying News:** https://phying.com/item/4382