CVE-2024-45600: GLPI Fields Plugin SQL Injection Flaw

CVE-2024-45600 Overview

CVE-2024-45600 is a SQL injection vulnerability [CWE-89] in the Fields plugin for GLPI, an open-source IT asset and service management platform. The Fields plugin allows administrators to add custom fields on GLPI item forms. In versions prior to 1.21.13, an authenticated user can inject arbitrary SQL statements when the plugin is active. The maintainers fixed the vulnerability in release 1.21.13 by sanitizing the affected input parameter.

Critical Impact
An authenticated attacker can extract sensitive data from the GLPI database, including credentials, asset inventories, and ticket contents, by exploiting the injection in the tab container lookup.

Affected Products

GLPI Fields plugin versions prior to 1.21.13
GLPI instances with the Fields plugin enabled
Any authenticated GLPI user role capable of reaching tab endpoints

Discovery Timeline

2024-12-26 - CVE-2024-45600 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45600

Vulnerability Analysis

The flaw resides in the tab container resolution logic of the Fields plugin, specifically in inc/container.class.php. When GLPI renders a custom tab, the plugin queries the container model using the $tabnum request parameter without sanitization. Because $tabnum reaches the find() method as part of the SQL WHERE clause, an authenticated attacker can inject SQL fragments through the tab identifier.

Exploitation requires only low-privileged authenticated access, and the impact crosses a security scope boundary since the injected query executes against the shared GLPI database backing multiple entities.

Root Cause

The root cause is missing input sanitization on the $tabnum parameter passed to the find() query builder. The pre-patch code trusted the tab identifier as safe, allowing crafted values to alter the intended SQL semantics.

Attack Vector

An authenticated attacker sends a crafted HTTP request that references a manipulated tab identifier on an item form served by the Fields plugin. The malicious tabnum value is concatenated into the underlying query, allowing UNION-based or boolean-based extraction of data from any table accessible to the GLPI database user.

php

         //retrieve container for current tab
         $container = new self();
-        $found_c   = $container->find(['type' => 'tab', 'name' => $tabnum, 'is_active' => 1]);
+        $found_c   = $container->find(['type' => 'tab', 'name' => Sanitizer::sanitize($tabnum), 'is_active' => 1]);
         foreach ($found_c as $data) {
             $dataitemtypes = json_decode($data['itemtypes']);
             if (in_array(get_class($item), $dataitemtypes) != false) {

Source: GitHub commit eb927b0. The patch wraps $tabnum with Sanitizer::sanitize() before it reaches the query builder, neutralizing SQL metacharacters supplied by the caller.

Detection Methods for CVE-2024-45600

Indicators of Compromise

Web server access logs containing GLPI tab request URLs with SQL metacharacters such as single quotes, UNION, SELECT, or comment sequences in tabnum values.
Unexpected MySQL or MariaDB errors logged by GLPI referencing the glpi_plugin_fields_containers table.
Authenticated sessions issuing atypical volumes of requests to Fields plugin endpoints within short time windows.

Detection Strategies

Inspect HTTP request parameters delivered to GLPI item form handlers for encoded SQL syntax targeting the tabnum field.
Correlate authenticated GLPI user sessions with database query patterns that deviate from normal Fields plugin behavior.
Alert on GLPI processes spawning outbound connections or reading credential files after suspicious tab requests.

Monitoring Recommendations

Enable GLPI SQL query logging and forward events to a centralized analytics platform for retrospective hunting.
Deploy a web application firewall rule set with SQL injection signatures in front of GLPI.
Track the installed version of the Fields plugin across GLPI instances and flag any deployment below 1.21.13.

How to Mitigate CVE-2024-45600

Immediate Actions Required

Upgrade the GLPI Fields plugin to version 1.21.13 or later on every GLPI instance.
Audit GLPI user accounts and revoke unnecessary authenticated access while patching is scheduled.
Review database and application logs for signs of prior exploitation attempts against Fields plugin endpoints.

Patch Information

The maintainers released a fix in GLPI Fields 1.21.13. The commit adds Sanitizer::sanitize() around the $tabnum parameter before it is used in the query. Administrators should replace the plugin directory with the patched release and clear GLPI caches.

Workarounds

Temporarily disable the Fields plugin in GLPI configuration until the patched release is installed.
Restrict authenticated GLPI access to trusted internal networks using firewall or reverse proxy rules.
Apply a WAF rule that rejects requests containing SQL metacharacters in tab parameter names for GLPI URLs.

bash

# Update the Fields plugin to the fixed release
cd /var/www/glpi/plugins
rm -rf fields
curl -L -o fields-1.21.13.tar.gz \
  https://github.com/pluginsGLPI/fields/releases/download/1.21.13/glpi-fields-1.21.13.tar.gz
tar xzf fields-1.21.13.tar.gz
chown -R www-data:www-data fields
# Then log into GLPI and re-enable the plugin under Setup > Plugins