CVE-2025-24799

Published Mar 18, 2025

Last updated a year ago

GLPI

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-24799 is a SQL injection vulnerability found in GLPI, a free IT asset management software package. It affects versions up to 10.0.17. The vulnerability exists in the inventory endpoint, allowing an unauthenticated user to perform SQL injection attacks. Specifically, the vulnerability stems from inadequate sanitization of SQL queries within the `handleAgent` function in `/src/Agent.php`, which is used for inventory purposes. By sending specially crafted HTTP requests, attackers can inject harmful SQL commands. Successful exploitation could lead to the retrieval of sensitive data, privilege escalation, and potentially remote code execution (RCE). GLPI version 10.0.18 fixes this vulnerability.

Description: GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18.
Source: security-advisories@github.com
NVD status: Analyzed
Products: glpi

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security-advisories@github.com: CWE-89

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:glpi-project:glpi:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "7ECD51EF-73D1-42AB-A241-BD4C73D649BA",
            "versionEndExcluding": "10.0.18",
            "versionStartIncluding": "10.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.