CVE-2024-45608 Overview
CVE-2024-45608 is a SQL injection vulnerability in GLPI, an open-source asset and IT management software package. Authenticated users can inject arbitrary SQL statements by modifying their own account preferences. The flaw affects GLPI versions prior to 10.0.17 and is tracked under CWE-89: SQL Injection. Because exploitation requires only a low-privileged account, any authenticated GLPI user, including self-registered accounts, can leverage the flaw to read, modify, or destroy database contents.
Critical Impact
Authenticated attackers can execute arbitrary SQL against the GLPI database, exposing asset inventories, credentials, and ticket data with high impact to confidentiality, integrity, and availability.
Affected Products
- GLPI versions prior to 10.0.17
- glpi-project/glpi (all builds shipped before the November 2024 patch)
- Deployments that permit self-service account registration are at elevated risk
Discovery Timeline
- 2024-11-15 - CVE-2024-45608 published to NVD
- 2024-11-15 - GitHub Security Advisory GHSA-67p8-v79j-jp86 issued by the GLPI project
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-45608
Vulnerability Analysis
The vulnerability resides in the user preferences workflow of GLPI. When an authenticated user updates preference fields, one or more values are concatenated into a SQL query without adequate sanitization or parameterization. This allows an attacker to break out of the intended query context and append arbitrary SQL clauses. The issue is classified as CWE-89, reflecting improper neutralization of special elements in an SQL command. The EPSS probability of 0.524% (percentile 41.7) indicates a moderate likelihood of near-term exploitation attempts against exposed instances.
Root Cause
The root cause is missing input validation and lack of prepared statements in the preference-update handler. GLPI trusts values submitted by an authenticated session and passes them into query construction routines that build SQL dynamically. Because the preference form is available to every authenticated user, the attack surface extends across the entire user population rather than being restricted to administrators.
Attack Vector
An attacker first authenticates to GLPI using any valid account. The attacker then submits a crafted preference update over HTTP or HTTPS that embeds SQL syntax in a preference parameter. The backend executes the injected statement with the privileges of the GLPI database user. From this position, an attacker can extract user credentials, escalate to administrative accounts by manipulating rows in the users table, or pivot to arbitrary reads and writes against connected data. No user interaction beyond the attacker's own session is required.
No verified public proof-of-concept code is available. See the GLPI GitHub Security Advisory for vendor-supplied technical details.
Detection Methods for CVE-2024-45608
Indicators of Compromise
- HTTP POST requests to GLPI preference endpoints containing SQL metacharacters such as single quotes, UNION, SELECT, --, or /* in preference field values
- Unexpected modifications to the glpi_users table, particularly to password hashes or profile assignments, outside normal administrator workflows
- New administrator-level accounts or privilege changes that do not correlate with an audit log entry from a legitimate admin session
- Database error entries in GLPI logs referencing malformed queries originating from preference save actions
Detection Strategies
- Enable SQL query logging on the GLPI database and alert on queries containing tautologies (OR 1=1), stacked statements, or INFORMATION_SCHEMA references sourced from the GLPI application user
- Deploy a Web Application Firewall (WAF) rule set that inspects preference-update requests for SQL injection patterns
- Correlate authentication events with subsequent preference changes to identify accounts performing anomalous update volumes
Monitoring Recommendations
- Forward GLPI application and web server logs to a centralized logging or SIEM platform and retain them for post-incident review
- Monitor for outbound database connections or exfiltration patterns from the GLPI host that deviate from baseline
- Track version strings exposed by GLPI to identify unpatched instances across the environment
How to Mitigate CVE-2024-45608
Immediate Actions Required
- Upgrade all GLPI instances to version 10.0.17 or later without delay
- Audit the glpi_users table for unexpected privilege escalations or password changes since the vulnerability was disclosed
- Rotate credentials for the GLPI database service account and any application secrets stored within GLPI
- Restrict GLPI access to trusted networks or place it behind a VPN if exposure to the public internet is not required
Patch Information
The GLPI project addressed the vulnerability in version 10.0.17. Administrators should follow the upgrade path documented in the GitHub Security Advisory GHSA-67p8-v79j-jp86. Verify the installed version through the GLPI administration interface after the upgrade completes.
Workarounds
- Disable self-service account registration to reduce the pool of accounts capable of exploiting the flaw
- Apply strict WAF rules that block SQL metacharacters in preference-update parameters until patching is complete
- Limit database privileges of the GLPI application account to the minimum required set, blocking access to unrelated schemas
# Verify the installed GLPI version after upgrading
grep -R "GLPI_VERSION" /var/www/glpi/inc/define.php
# Example WAF ModSecurity rule to block SQL metacharacters in preference updates
SecRule REQUEST_URI "@contains /front/preference.php" \
"chain,deny,status:403,id:1004560801,msg:'Possible CVE-2024-45608 SQLi attempt'"
SecRule ARGS "@rx (?i)(union(\s|/\*).*select|--|;|/\*|xp_)" "t:none"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
