CVE-2024-37148

What it actually does

Authenticated SQL injection in AJAX scripts permits modification of user account records, enabling privilege escalation and account takeover.

Why it matters to the business

Compromise of administrative accounts in an IT asset and service management platform can expose sensitive inventory, licenses, and configuration data, disrupting operations and compliance.

How an attack unfolds

An authenticated attacker identifies vulnerable AJAX endpoints, injects crafted SQL payloads via request parameters to alter password hashes or roles of other users, then authenticates as the compromised account to gain elevated control.

How to fix it

Upgrade glpi-project/glpi to the fixed version containing commit 683393a84eeff1e165fa0f9f31067cc9add09b70 (equivalent to 10.0.16).

How to confirm the fix worked

Confirm deployed version matches or exceeds the fixed commit, review changelog for the SQL injection patches, and test AJAX endpoints with injection payloads in a non-production environment.

Typical attack path

1. Obtain valid GLPI credentials
2. Locate exposed AJAX scripts handling user data
3. Submit malicious SQL via crafted POST/GET parameters
4. Trigger update of target account credentials or permissions
5. Authenticate using the modified account

How to detect it

Review web server and application logs for anomalous SQL syntax or unexpected updates to the glpi_users table; correlate with successful logins from altered accounts.

What your security team should do

• Apply the upgrade to the fixed commit immediately
• Audit recent user account modifications in GLPI logs
• Restrict AJAX endpoint access to least-privilege roles
• Enable web application firewall rules targeting SQL injection patterns