CVE-2024-40638: GLPI SQL Injection Vulnerability

CVE-2024-40638 Overview

CVE-2024-40638 is a SQL injection vulnerability in GLPI, an open-source asset and IT service management (ITSM) platform. Authenticated users can exploit multiple SQL injection flaws in the application. One of these flaws allows an attacker to modify another user's account data and take control of that account. The vulnerability affects GLPI versions prior to 10.0.17, and the project maintainers have released a fix in version 10.0.17. The issue is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated attackers can chain SQL injection with account manipulation to hijack privileged GLPI accounts and compromise IT asset management data.

Affected Products

GLPI versions earlier than 10.0.17
glpi-project/glpi deployments exposed to authenticated users
Self-hosted GLPI instances used for asset and IT service management

Discovery Timeline

2024-11-15 - CVE-2024-40638 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-40638

Vulnerability Analysis

GLPI contains multiple SQL injection paths reachable by authenticated users. The vulnerability class (CWE-89) results from concatenating user-controlled input directly into SQL statements without proper parameterization or sanitization. Attackers with any valid session can inject crafted SQL fragments through vulnerable request parameters. One injection path targets tables holding user account data, enabling modification of email addresses, password hashes, or profile associations belonging to other users. Successful exploitation yields account takeover, including takeover of accounts with higher privileges than the attacker's own. Because GLPI centralizes inventory, ticketing, and infrastructure metadata, a compromised administrator account exposes sensitive organizational data and can be used as a pivot point.

Root Cause

The root cause is improper neutralization of user input incorporated into SQL queries within GLPI request handlers. Affected code paths trusted authenticated input and failed to apply prepared statements or strict type casting. The fix in version 10.0.17 corrects the vulnerable query construction.

Attack Vector

Exploitation requires network access to the GLPI web interface and valid authenticated credentials, including low-privilege accounts. An attacker submits crafted parameter values to a vulnerable endpoint, injecting SQL that updates records belonging to other users. The attacker then authenticates as the hijacked user and inherits their permissions. See the GLPI security advisory GHSA-8843-r3m7-gfqx for maintainer guidance.

// No verified public exploit code is available.
// Refer to the vendor advisory for technical details.

Detection Methods for CVE-2024-40638

Indicators of Compromise

Unexpected changes to user records in the glpi_users table, including email address or password hash modifications without a corresponding administrator action.
Authentication events for user accounts originating from unusual IP addresses or geolocations shortly after suspicious HTTP requests.
Web server access logs containing SQL metacharacters (', --, UNION, SELECT, SLEEP() in GLPI request parameters.

Detection Strategies

Enable database query logging and alert on UPDATE statements against user tables originating from GLPI PHP workers outside expected administrative workflows.
Deploy a web application firewall (WAF) with signatures for SQL injection patterns targeting GLPI endpoints.
Correlate GLPI application logs with authentication logs to detect account modifications immediately followed by logins from new sessions.

Monitoring Recommendations

Monitor GLPI audit logs for privilege changes, profile reassignments, and password resets that lack a legitimate administrative source.
Track HTTP request rates and parameter entropy against GLPI endpoints to surface automated injection probing.
Alert on outbound connections from the GLPI database host that deviate from baseline behavior.

How to Mitigate CVE-2024-40638

Immediate Actions Required

Upgrade all GLPI instances to version 10.0.17 or later without delay.
Rotate credentials for GLPI administrator and service accounts after patching to invalidate any tokens obtained pre-patch.
Review the glpi_users and profile assignment tables for unauthorized modifications since the vulnerability's disclosure.

Patch Information

The GLPI project fixed CVE-2024-40638 in release 10.0.17. Details are published in the GitHub Security Advisory GHSA-8843-r3m7-gfqx. Administrators should follow the standard GLPI upgrade procedure and apply database schema migrations included in the release.

Workarounds

Restrict GLPI web interface access to trusted networks or via VPN until the upgrade is complete.
Enforce strong authentication, including multi-factor authentication, to limit which accounts an attacker can obtain to reach the vulnerable endpoints.
Deploy WAF rules to block SQL injection payloads targeting GLPI request parameters as a temporary compensating control.

bash

# Example: verify the installed GLPI version after upgrade
php /var/www/glpi/bin/console --version

# Example: restrict access to the GLPI web interface via nginx
# location /glpi/ {
#     allow 10.0.0.0/8;
#     deny all;
# }