CVE-2024-29889 Overview
GLPI is a free asset and IT management software package used by organizations to track infrastructure, tickets, and inventory. CVE-2024-29889 is a SQL injection vulnerability [CWE-89] in the saved searches feature of GLPI versions prior to 10.0.15. An authenticated user can exploit the flaw to alter another user's account data and take control of that account. The GLPI project fixed the issue in version 10.0.15. The vulnerability requires only low-privilege authentication and no user interaction, making it exploitable through the network attack surface exposed by GLPI installations.
Critical Impact
Authenticated attackers can inject SQL through saved searches to modify account records of other users, including administrators, resulting in account takeover.
Affected Products
- GLPI versions prior to 10.0.15
- glpi-project/glpi (source distribution)
- Self-hosted GLPI deployments exposing the saved searches feature to authenticated users
Discovery Timeline
- 2024-05-07 - CVE-2024-29889 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-29889
Vulnerability Analysis
The vulnerability resides in GLPI's saved searches feature, which persists user-defined query criteria for reuse. The affected code path fails to properly parameterize or sanitize input before including it in SQL statements. An authenticated user can craft a saved search containing malicious SQL that executes against the backing database when processed by GLPI. Because GLPI stores user credentials and profile data in the same database, an attacker can modify another user's row, including password hash or email fields, and pivot into that account.
The flaw is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The vulnerability affects confidentiality and integrity of user account data. Availability is not directly impacted according to the published CVSS vector.
Root Cause
The root cause is unsafe construction of SQL statements from user-controlled saved search parameters. Input flowing from the saved searches feature reaches the query layer without adequate binding or escaping, allowing operators, comments, and stacked clauses to alter query semantics. The fix commit 0a6b28be4c0f848106c60b554c703ec2e178d6c7 addresses the affected query construction in GLPI 10.0.15.
Attack Vector
An attacker authenticates to GLPI with any valid low-privilege account. The attacker then submits a crafted saved search whose parameters embed SQL syntax that alters an UPDATE or SELECT operation against the users table. By modifying fields such as the password hash or recovery email of a targeted account, the attacker gains a path to authenticate as that user. Full technical detail is available in the GLPI Security Advisory GHSA-8xvf-v6vv-r75g.
No verified public proof-of-concept code is referenced in the advisory. See the GitHub commit for the patch for the corrected query logic.
Detection Methods for CVE-2024-29889
Indicators of Compromise
- Unexpected modifications to glpi_users rows, particularly to password, password_last_update, or email fields, without corresponding administrator activity.
- Saved search records in glpi_savedsearches containing SQL keywords such as UNION, UPDATE, SELECT, or comment tokens (--, #, /*).
- Successful logins to privileged accounts from IP addresses or user agents not previously associated with those accounts.
- Database error entries in GLPI logs referencing malformed queries originating from the saved searches component.
Detection Strategies
- Review the glpi_savedsearches table for entries whose query column contains SQL metacharacters or keywords outside the expected search parameter format.
- Correlate saved search creation events with subsequent changes to user account records within a short time window.
- Enable and inspect database query logs for statements against glpi_users originating from the web application user during saved search execution.
Monitoring Recommendations
- Monitor GLPI application logs for HTTP requests to saved search endpoints containing encoded SQL syntax.
- Alert on password or email changes to administrator accounts that do not originate from the account owner's session.
- Track authentication events for privileged GLPI users and flag logins that follow recent saved search activity by other accounts.
How to Mitigate CVE-2024-29889
Immediate Actions Required
- Upgrade GLPI to version 10.0.15 or later without delay.
- Audit all accounts with elevated GLPI profiles for unauthorized password, email, or profile changes since the vulnerable version was deployed.
- Rotate credentials for administrator and technician accounts after upgrading.
- Review the contents of the glpi_savedsearches table and remove any entries containing suspicious SQL syntax.
Patch Information
The GLPI project released version 10.0.15 containing the fix. The relevant source change is available in commit 0a6b28be4c0f848106c60b554c703ec2e178d6c7. Administrators should follow the upgrade instructions in the GLPI Security Advisory GHSA-8xvf-v6vv-r75g.
Workarounds
- Restrict access to the GLPI instance to trusted networks using a reverse proxy or firewall until the upgrade is applied.
- Disable or restrict the saved searches feature for non-administrative profiles through GLPI role configuration where possible.
- Enforce strong authentication and remove unused or dormant GLPI accounts to reduce the pool of accounts capable of triggering the vulnerability.
- Place a web application firewall in front of GLPI with rules that block common SQL injection payloads in saved search parameters.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
