CVE-2024-45608

What it actually does

An authenticated user can inject arbitrary SQL statements into backend database queries by manipulating preference settings, allowing unauthorized data access or modification.

Why it matters to the business

Attackers with valid credentials could extract or alter sensitive asset and IT management data, leading to confidentiality breaches, data integrity issues, and potential compliance violations in environments running the affected software.

How an attack unfolds

An attacker authenticates with a low-privileged account, navigates to the user preferences interface, and submits crafted input containing SQL syntax that is executed unsafely when the application processes the preference update.

How to fix it

Upgrade to version 10.0.17 or apply the fix from commit 08ee4d266768dc1f76cb6c716d7fd118d39676d9 in the glpi-project/glpi repository.

How to confirm the fix worked

Confirm the installed version is 10.0.17 or later, review the commit history to verify inclusion of 08ee4d266768dc1f76cb6c716d7fd118d39676d9, and test that preference updates no longer permit SQL syntax in input fields.

Typical attack path

1. Obtain valid user credentials for the application
2. Log in and access the personal preferences section
3. Modify preference values with SQL injection payloads
4. Trigger the preference save operation to execute injected queries
5. Observe results or exfiltrate data via application responses or side channels

How to detect it

Examine application and database logs for unexpected SQL syntax or errors originating from preference update endpoints, and correlate with authenticated user sessions performing atypical preference modifications.

What your security team should do

• Immediately upgrade all instances to the fixed version
• Review and restrict user permissions for preference modification where possible
• Monitor authentication logs for unusual preference change activity