Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionGitHub Advisory
GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18.
AnalysisAI
GLPI IT asset management platform contains an unauthenticated SQL injection through the inventory endpoint. Attackers can extract the entire GLPI database including asset inventories, user credentials, helpdesk tickets, and IT infrastructure documentation without any authentication.
Technical ContextAI
The inventory API endpoint processes incoming inventory data without proper SQL parameterization. An unauthenticated attacker can inject SQL through inventory submission parameters, extracting data from the GLPI database. This endpoint is typically exposed to allow automated inventory agents to submit data.
RemediationAI
Update to GLPI 10.0.18. Restrict inventory endpoint access to known agent IP ranges. Implement network segmentation for GLPI. Rotate all user passwords if exploitation is suspected.
Share
External POC / Exploit Code
Leaving vuln.today