GLPI vulnerable to SQL injection through Computer Virtual Machine information
33Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 48%
exploitation probability
48%top 1% of all CVEs
observed exploitation
nono source reports it
In short
GLPI, a free IT management software, has a flaw in its Computer Virtual Machine form that allows attackers to inject malicious SQL commands. This could let an attacker steal, modify, or delete sensitive data from the system.
Technical detail
SQL injection vulnerability exists in the Computer Virtual Machine form processing in GLPI versions 0.80 through 10.0.7, exploitable via inventory requests without proper input sanitization. An attacker with access to submit VM information can execute arbitrary SQL queries, potentially compromising data integrity and confidentiality of the entire database.
Summary generated and translated by AI from the official description.
GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. Version 10.0.8 has a patch for this issue. As a workaround, one may disable native inventory.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected products
glpi-project · glpi