CVE-2024-40638

What it actually does

Authenticated users can inject malicious SQL queries through multiple endpoints, enabling modification of user account data to achieve account takeover.

Why it matters to the business

Attackers with valid credentials can hijack administrative or other user accounts, leading to unauthorized access to sensitive IT asset data and potential full system compromise. Moderate exploitation probability near 38% with slight recent increase in interest.

How an attack unfolds

An attacker authenticates with a valid GLPI account, crafts specially formatted input containing SQL payloads in vulnerable parameters, and submits requests that the unsanitized application executes to alter another user's account data such as password or email fields, granting control of the target account.

How to fix it

Upgrade GLPI to version 10.0.17 or apply commit 08ee4d266768dc1f76cb6c716d7fd118d39676d9. Update any affected chromium-browser packages on Ubuntu 14.04 LTS to 52.0.2743.116-0ubuntu0.14.04.1.1134.

How to confirm the fix worked

Confirm deployed version matches or exceeds the fixed release, then attempt known injection patterns in a test environment to verify input sanitization blocks unauthorized queries.

Typical attack path

1. Obtain valid low-privileged GLPI credentials
2. Locate vulnerable input fields or API endpoints handling user data
3. Craft and submit SQL injection payloads targeting user account modification
4. Verify and leverage control of the altered account for further actions

How to detect it

Review GLPI application and database logs for unexpected SQL syntax errors, queries referencing user tables outside normal flows, or sudden account modifications lacking corresponding audit entries from legitimate sessions.

What your security team should do

• Prioritize upgrade of all GLPI instances to 10.0.17 within the next maintenance window
• Audit current user permissions and revoke unnecessary privileges
• Enable enhanced database query logging for anomaly detection
• Deploy virtual patching via WAF rules for any delayed upgrades