Exploitation Summary
EIP tracks 1 public exploit for EIP-2026-107436. PoCs published by Vadym Soroka.
AI-analyzed exploit summary The writeup details an unsafe reflection vulnerability in GLPI <=9.5.3, where the `getItemForItemtype()` function instantiates arbitrary classes without proper input validation, allowing unauthenticated attackers to trigger sensitive operations via constructors or destructors. The analysis includes vulnerable code snippets, a proof-of-concept request, and references to technical advisories.
Description
GLPI 9.5.3 - 'fromtype' Unsafe Reflection
Exploits (1)
The writeup details an unsafe reflection vulnerability in GLPI <=9.5.3, where the `getItemForItemtype()` function instantiates arbitrary classes without proper input validation, allowing unauthenticated attackers to trigger sensitive operations via constructors or destructors. The analysis includes vulnerable code snippets, a proof-of-concept request, and references to technical advisories.