CVE-2025-24799: GLPI Asset Management SQLi Vulnerability

CVE-2025-24799 Overview

GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18.

Critical Impact

This SQL injection vulnerability could allow unauthenticated users to execute arbitrary SQL commands, potentially leading to unauthorized data access and manipulation.

Affected Products

• glpi-project glpi
• Not Available
• Not Available

Discovery Timeline

• Not Available - Vulnerability discovered by Not Available
• Not Available - Responsible disclosure to glpi-project
• Not Available - CVE CVE-2025-24799 assigned
• Not Available - glpi-project releases security patch
• 2025-03-18 - CVE CVE-2025-24799 published to NVD
• 2025-07-31 - Last updated in NVD database

Technical Details for CVE-2025-24799

Vulnerability Analysis

The vulnerability is a classic SQL injection that allows attackers to execute unauthorized SQL commands through the inventory endpoint of GLPI. It can be exploited to gain access to sensitive data without authentication.

Root Cause

Improper input validation in the inventory endpoint allows injection of malicious SQL commands.

Attack Vector

Network

-- Example exploitation query
SELECT * FROM users WHERE id = '1' OR '1'='1';

Detection Methods for CVE-2025-24799

Indicators of Compromise

• Unusual database access patterns
• Unexpected data modifications
• Unauthorized access logs

Detection Strategies

Configure monitoring on database queries for patterns of anomalous requests and use of SQL keywords like OR, AND, SELECT that do not match expected usage patterns.

Monitoring Recommendations

Ensure consistent logging of all database interactions. Implement real-time monitoring solutions that flag suspicious queries and user access.

How to Mitigate CVE-2025-24799

Immediate Actions Required

• Apply the security update for GLPI version 10.0.18 immediately.
• Implement Web Application Firewall (WAF) rules to block SQL injection patterns.
• Audit and sanitize input fields, especially on the inventory endpoints.

Patch Information

The vulnerability is fixed in GLPI version 10.0.18. Users should update to this version or later to secure their systems.

Workarounds

Employ input validation and parameterized queries to prevent injection of malicious SQL commands.

# Example mitigation configuration
function sanitize_input(input) {
  input = stripslashes(input);
  input = mysql_real_escape_string(input);
  return input;
}