Cloudanix VulnDB

CVE-2024-41679

High · 8.8

CVSS

8.8

EPSS

0.5%

Published

Nov 15, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A logged-in user could trick the system into running unauthorized database commands through the normal ticket submission screen, risking exposure or tampering with company IT records.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Data Exposure
Component
Application
Class
SQL Injection
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Authenticated SQL injection in the ticket form allowing arbitrary query execution against the backend database.

Why it matters to the business

Attackers with valid credentials can read, modify, or delete sensitive asset and IT management data, potentially disrupting operations and exposing confidential records.

How an attack unfolds

An authenticated user submits crafted input through the ticket form that is concatenated unsafely into SQL statements, enabling direct database manipulation without additional authentication bypass.

How to fix it

Upgrade glpi-project/glpi to version 10.0.17 or apply commit 08ee4d266768dc1f76cb6c716d7fd118d39676d9; remove or restrict access to the ticket form for untrusted authenticated users until patched.

How to confirm the fix worked

Verify the installed GLPI version is 10.0.17 or later; attempt previously exploitable ticket form inputs in a test environment and confirm they no longer produce unexpected database behavior or errors.

Typical attack path

  1. Obtain valid GLPI user credentials
  2. Navigate to the ticket creation or edit form
  3. Inject malicious SQL payload into form fields
  4. Submit the request to trigger database query execution
  5. Exfiltrate, modify, or delete data via returned results or side effects

How to detect it

Inspect web server and application logs for unusual SQL syntax or errors originating from ticket form endpoints; monitor database query logs for unexpected SELECT, UNION, or data manipulation statements tied to ticket operations.

  • ticket form POST requests containing SQL metacharacters
  • database errors referencing syntax near ticket-related tables
  • unusual UNION SELECT patterns in application logs

What your security team should do

  • Immediately upgrade all GLPI instances to the fixed version
  • Review and tighten database user privileges used by the application
  • Enable web application firewall rules to detect SQL injection patterns in ticket endpoints
  • Audit recent ticket form submissions for anomalous input

The record

GLPI is a free asset and IT management software package. An authenticated user can exploit a SQL injection vulnerability from the ticket form. Upgrade to 10.0.17.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:16.04:LTS glpi 0 No fix
Ubuntu:Pro:16.04:LTS glpi 0 No fix

Related vulnerabilities