CVE-2023-36808highCWE-89

CVE-2023-36808: high-severity vulnerability in glpi-project glpi

GLPI vulnerable to SQL injection through Computer Virtual Machine information

Published · Updated

33Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.6epss 52%
exploitation probability
52%top 1% of all CVEs
observed exploitation
nono source reports it
In short

GLPI, a free IT management software, has a flaw in its Computer Virtual Machine form that allows attackers to inject malicious SQL commands. This could let an attacker steal, modify, or delete sensitive data from the system.

Technical detail

SQL injection vulnerability exists in the Computer Virtual Machine form processing in GLPI versions 0.80 through 10.0.7, exploitable via inventory requests without proper input sanitization. An attacker with access to submit VM information can execute arbitrary SQL queries, potentially compromising data integrity and confidentiality of the entire database.

Summary generated and translated by AI from the official description.
GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. Version 10.0.8 has a patch for this issue. As a workaround, one may disable native inventory.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected products
glpi-project · glpi
Related CVEs — glpi-project glpi

In the same product, most dangerous first.

CVE-2025-24799HIGHGLPI allows unauthenticated SQL injection through the inventory endpointEPSS 86.7%CVE-2020-15175HIGHUnauthenticated File Deletion in GLPIEPSS 71.5%CVE-2023-46727HIGHGLPI SQL injection through inventory agent requestEPSS 67.7%CVE-2024-29889HIGHGLPI contains an SQL injection through the saved searchesEPSS 63.0%CVE-2024-31456HIGHGLPI contains an authenticated SQL injectionEPSS 59.1%CVE-2024-27096HIGHSQL Injection in through the search engineEPSS 58.8%
References
https://github.com/glpi-project/glpi/releases/tag/10.0.8https://github.com/glpi-project/glpi/security/advisories/GHSA-vf5h-jh9q-2gjm