CVE-2024-41679 Overview
CVE-2024-41679 is a SQL injection vulnerability in GLPI, an open-source asset and IT management software package. An authenticated user can exploit the vulnerability through the ticket form to inject arbitrary SQL statements into backend database queries. Successful exploitation compromises the confidentiality, integrity, and availability of the underlying database. The GLPI project addressed the issue in version 10.0.17.
Critical Impact
Authenticated attackers can execute arbitrary SQL against the GLPI database via the ticket form, exposing sensitive asset and IT management data.
Affected Products
- GLPI versions prior to 10.0.17
- glpi-project/glpi (open-source distribution)
- Deployments exposing the ticket form to authenticated users
Discovery Timeline
- 2024-11-15 - CVE-2024-41679 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-41679
Vulnerability Analysis
The vulnerability is a SQL injection [CWE-89] reachable from the GLPI ticket form. GLPI is a widely deployed PHP-based asset and IT service management platform. The ticket workflow is central to GLPI usage, meaning any authenticated user with ticket access can reach the vulnerable code path.
Exploitation requires authentication but no elevated privileges. Because GLPI installations commonly grant ticket creation rights to standard users, the barrier to exploitation is low. Successful injection can read arbitrary database contents, modify records, or disrupt service depending on database engine permissions.
The attack is network-reachable and requires no user interaction. The GLPI security team resolved the issue in the 10.0.17 release, as documented in the GitHub Security Advisory.
Root Cause
The root cause is improper neutralization of special elements used in an SQL command. Input supplied through fields in the ticket form is concatenated into SQL statements without adequate parameterization or sanitization. Attackers craft payloads that break out of the intended query context and append attacker-controlled SQL.
Attack Vector
An authenticated attacker submits a crafted request to the ticket form endpoint. The malicious input flows into a backend SQL query, where injected clauses alter query semantics. The attacker can then extract data through boolean-based, time-based, or UNION-based techniques.
Refer to the GLPI Security Advisory GHSA-hq9q-jfhp-qqgm for technical details on affected parameters and fix commits.
Detection Methods for CVE-2024-41679
Indicators of Compromise
- Unusual POST requests to GLPI ticket form endpoints containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP, or comment sequences (--, /*).
- Web server access logs showing long or URL-encoded payloads targeting ticket parameters from authenticated sessions.
- Database logs recording syntax errors, unexpected UNION queries, or long-running queries originating from the GLPI application user.
- Sudden spikes in ticket creation or edit activity from a single account.
Detection Strategies
- Inspect HTTP traffic to GLPI for SQL injection signatures in ticket-related parameters using a web application firewall or IDS.
- Correlate authenticated GLPI session activity with database query anomalies, including error rates and query duration.
- Review GLPI application logs for authorization events tied to accounts submitting malformed ticket data.
Monitoring Recommendations
- Enable verbose query logging on the database backend for the GLPI service account and forward logs to a centralized SIEM.
- Monitor for outbound data transfers from the GLPI web tier that deviate from baseline volumes.
- Alert on repeated 500-series responses from GLPI ticket endpoints, which often accompany injection probing.
How to Mitigate CVE-2024-41679
Immediate Actions Required
- Upgrade GLPI to version 10.0.17 or later without delay.
- Audit user accounts and revoke ticket access for unused or dormant accounts to reduce the exploitation surface.
- Rotate database credentials used by GLPI if compromise is suspected.
- Review database logs for evidence of prior exploitation attempts against the ticket form.
Patch Information
The GLPI project released version 10.0.17 to fix CVE-2024-41679. Administrators should apply this update through their standard GLPI upgrade process. See the GLPI GitHub Security Advisory for release details and upgrade instructions.
Workarounds
- No official workaround is published; upgrading to 10.0.17 is the supported remediation.
- Restrict network access to the GLPI interface to trusted networks or VPN-only clients as a temporary control.
- Deploy a web application firewall rule to block SQL injection patterns targeting ticket form parameters until patching is complete.
# Example WAF-style pattern to flag suspicious ticket form input
# (Adapt to your WAF syntax; test before enforcing in production)
SecRule ARGS_NAMES "@rx ^(name|content|_users_id_.*|itilcategories_id)$" \
"chain,phase:2,deny,status:403,id:1004167901,msg:'Possible GLPI CVE-2024-41679 SQLi'"
SecRule ARGS "@rx (?i)(\bunion\b.*\bselect\b|--|/\*|\bsleep\s*\(|\bor\b\s+1=1)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
