EUVD-2026-42993
GHSA-q93h-qc46-87rr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable low-complexity injection, but gated by high import privileges (PR:H) and an operator-triggered import (UI:R); demonstrated primitive is blind data read (C:H) with only plausible limited write (I:L).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly into SQL queries during CSV import, without parameterization or escaping, resulting in authenticated SQL injection. An authenticated user with access to the Data injection feature can embed SQL expressions such as SLEEP() in a mapped field (for example Serial Number) to manipulate the generated query and extract database information via time-based blind injection.
AnalysisAI
Authenticated SQL injection in the GLPI DataInjection plugin 2.15.6 (GLPI 11 builds) lets an operator with access to the Data injection feature smuggle SQL into the database by placing expressions in CSV field values, which the import routine concatenates directly into queries without parameterization or escaping (CWE-89). By mapping a payload such as SLEEP() to a field like Serial Number, an attacker performs time-based blind extraction of arbitrary database contents. Reported by VulnCheck and fixed in version 2.15.7; it is not on CISA KEV and no public exploit was identified at time of analysis.
Technical ContextAI
GLPI is an open-source IT asset management and service-desk (ITSM) platform; DataInjection is an official first-party plugin (pluginsGLPI/datainjection) that bulk-imports records from CSV/spreadsheet files by mapping columns to GLPI object fields. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): during CSV import the plugin builds SQL statements by string-concatenating user-supplied cell values instead of using prepared statements or GLPI's escaping helpers. Because the injection point is a mapped field value (e.g. Serial Number) rather than a URL parameter, it bypasses input validation that would normally apply to interactive forms, and the underlying MySQL/MariaDB backend then executes attacker-controlled clauses. The single affected product is identified by CPE cpe:2.3:a:pluginsglpi:datainjection:*:*:*:*:*:*:*:* with a fix tagged at release 2.15.7.
RemediationAI
Upgrade the plugin to the fixed release - Vendor-released patch: 2.15.7 (https://github.com/pluginsGLPI/datainjection/releases/tag/2.15.7) - which is the primary and complete fix. Until the upgrade is applied, restrict who holds the profile permission to reach the Data injection feature so that only a minimal, trusted set of administrators can run CSV imports; this reduces exposure but disrupts legitimate bulk-import workflows for the affected roles. As additional compensating controls, review and constrain the database account GLPI uses (least privilege, no unnecessary read access to sensitive tables) to limit what a blind-injection read can reach, and monitor for anomalous import activity or query latency patterns consistent with SLEEP()-based time-based injection. Consult the vendor advisory GHSA-57qv-j6r6-pcc4 and the VulnCheck advisory for authoritative details before and after patching.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today