GLPI Open Redirect Vulnerability in Versions Prior to 10.0.18

An open redirect vulnerability has been identified in GLPI versions prior to 10.0.17. The issue arises in the file '/index.php', where the 'redirect' parameter can be manipulated to redirect users to external sites. This vulnerability can be exploited remotely and does not require authentication, although it does require user interaction. The flaw has been publicly disclosed and is known to be easy to exploit, potentially leading to phishing attacks.

Impact

Exploitation of this vulnerability allows for open redirection, which can be used to conduct phishing attacks by redirecting users to malicious websites.

Reproduction

To reproduce this vulnerability, send a request to the '/index.php' endpoint with a crafted 'redirect' parameter that points to a malicious URL. The server will redirect the user to the specified URL, bypassing any security measures.

Remediation

Users are advised to upgrade to GLPI version 10.0.18, which addresses this vulnerability.