SQL Injection Vulnerability Affecting GLPI ITSM Platform
A high-severity SQL injection vulnerability has been discovered in GLPI, a widely used open-source IT asset and service management platform. An authenticated user could exploit this vulnerability to extract sensitive database records.
Description
Technical context and vulnerability details
GLPI is an open-source Information Technology Service Management (ITSM) and CMDB solution used by organizations worldwide to manage hardware inventory, software licenses, and helpdesk ticketing workflows.
These products are affected by the following vulnerabilities:
CVE-2025-24799: SQL injection vulnerability (CWE-89) in search and reporting modules. Parameter values are insufficiently sanitized before inclusion in database queries, allowing authenticated users to inject arbitrary SQL statements. Classified High with a CVSS v3.1 base score of 7.5.
Potential Risks & Impact
Potential consequences upon exploitation
- Unauthorized extraction of sensitive records including password hashes and asset inventories;
- Potential tampering with ticketing data and IT configuration management database (CMDB);
- Impact on the confidentiality and integrity of enterprise IT management systems.
Affected systems
Products, components and targeted versions
- GLPI: versions prior to 10.0.17.
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Immediately upgrade GLPI instances to version 10.0.17 or higher;
- Restrict access to the GLPI web portal to corporate intranet or VPN networks;
- Monitor database query logs for abnormal SQL syntax and automated extraction tools.
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.