CVE-2025-24799
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2Description
GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18.
Analysis
GLPI IT asset management platform contains an unauthenticated SQL injection through the inventory endpoint. Attackers can extract the entire GLPI database including asset inventories, user credentials, helpdesk tickets, and IT infrastructure documentation without any authentication.
Technical Context
The inventory API endpoint processes incoming inventory data without proper SQL parameterization. An unauthenticated attacker can inject SQL through inventory submission parameters, extracting data from the GLPI database. This endpoint is typically exposed to allow automated inventory agents to submit data.
Affected Products
['GLPI < 10.0.18']
Remediation
Update to GLPI 10.0.18. Restrict inventory endpoint access to known agent IP ranges. Implement network segmentation for GLPI. Rotate all user passwords if exploitation is suspected.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today