CVE-2013-5696

inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php...

6.8 MediumPublic exploit

inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and (1) perform a SQL injection via an Etape_4 action or (2) execute arbitrary PHP code via an update_1 action.

Exploit likelihood

7.67%Down 46.1 points since Feb 4, 2022

What each source reports

NVD Score used 6.8

Record: CVE-2013-5696
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-352
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-5696
Updated: 2026-11-02

EUVDEUVD-2013-5533 No score

Record: EUVD-2013-5533
Updated: 2026-11-03

GitHub AdvisoriesGHSA-c446-83mg-g9vm No score

inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php...

Record: GHSA-c446-83mg-g9vm
Weakness: CWE-352
Updated: 2026-11-02

OSVMGASA-2013-0288 No score

Updated glpi package fixes security vulnerabilities

Multiple security vulnerabilities due to improper sanitation of user input in GLPI before versions 0.83.9 (CVE-2013-2226), 0.83.91 (CVE-2013-2225), and 0.84.2 (CVE-2013-5696).

This update provides GLPI version 0.83.91, with a patch from GLPI 0.84.2, to fix these issues.

Record: MGASA-2013-0288
Updated: 2026-11-02

OSVUBUNTU-CVE-2013-5696 No score

Record: UBUNTU-CVE-2013-5696
Updated: 2026-11-02

Affected products

glpi-project glpi

Affected packages

Affected packages
Package	Affected	Fixed
`glpi` Mageia:3 From an advisory covering 3 CVEs	before 0.83.91-1.1.mga3	0.83.91-1.1.mga3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	GLPI install.php Remote Command Execution	2013-09-12
Exploit-DB	GLPI - 'install.php' Remote Command Execution (Metasploit)	2013-09-23
Exploit-DB	GLPI 0.84.1 - Multiple Vulnerabilities	2013-10-02

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, exploits, facts
Nov 3, 2026	affected
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-5696 is a medium vulnerability (CVSS 6.8) in Glpi-project Glpi, published September 20, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.67%, the 94th percentile. No source names a fixed version.

References

Show 6 moreShow less