CVE-2025-32786: GLPI Inventory Plugin SQLi Vulnerability

CVE-2025-32786 Overview

CVE-2025-32786 is a SQL Injection vulnerability affecting the GLPI Inventory Plugin, a component that handles network discovery, inventory, software deployment, and data collection for GLPI agents. Versions 1.5.0 and below are vulnerable to this SQL Injection flaw, which has been addressed in version 1.5.1.

Critical Impact

This SQL Injection vulnerability allows unauthenticated attackers to extract sensitive data from the GLPI database over the network, potentially exposing confidential inventory data, credentials, and other sensitive information managed by the GLPI system.

Affected Products

• GLPI Inventory Plugin versions 1.5.0 and earlier
• GLPI deployments utilizing the vulnerable inventory plugin
• Organizations relying on GLPI for IT asset management and network discovery

Discovery Timeline

• 2025-11-04 - CVE-2025-32786 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-32786

Vulnerability Analysis

This vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL Injection. The GLPI Inventory Plugin fails to properly sanitize user-supplied input before incorporating it into SQL queries, allowing attackers to manipulate database operations.

The vulnerability can be exploited remotely without authentication and does not require user interaction, making it particularly dangerous for internet-exposed GLPI installations. Successful exploitation could lead to unauthorized access to sensitive data stored in the GLPI database, including inventory records, network topology information, software deployment configurations, and potentially user credentials.

Root Cause

The root cause of CVE-2025-32786 stems from inadequate input validation and improper parameterization of SQL queries within the GLPI Inventory Plugin. When processing data from GLPI agents or user inputs related to network discovery and inventory functions, the plugin directly concatenates untrusted input into SQL statements rather than using prepared statements or parameterized queries. This fundamental coding error allows malicious SQL syntax to be interpreted and executed by the database engine.

Attack Vector

The attack vector for this vulnerability is network-based, allowing remote exploitation. An attacker can craft malicious input containing SQL syntax and submit it through the plugin's network discovery, inventory, or data collection interfaces. Since no authentication is required and the attack complexity is low, threat actors can leverage this vulnerability to:

1. Extract sensitive data from the GLPI database using UNION-based or blind SQL injection techniques
2. Enumerate database structure, table names, and column information
3. Access confidential inventory data, agent configurations, and potentially stored credentials
4. Map internal network topology through exposed inventory records

The vulnerability primarily impacts confidentiality, as attackers can read arbitrary data from the database. For detailed technical information, refer to the GitHub Security Advisory GHSA-w2cp-r675-6xpq.

Detection Methods for CVE-2025-32786

Indicators of Compromise

• Unusual SQL error messages in GLPI application logs indicating syntax errors or injection attempts
• Abnormal database query patterns, particularly queries with UNION SELECT statements or time-based delays
• Unexpected outbound connections from the database server to external hosts
• Evidence of data exfiltration through DNS queries or HTTP requests containing encoded database content

Detection Strategies

• Deploy Web Application Firewalls (WAF) with SQL injection detection rulesets to identify and block malicious payloads
• Enable detailed logging on the GLPI application and database to capture query patterns and error conditions
• Implement database activity monitoring to detect unusual query structures or access patterns
• Use SentinelOne Singularity to monitor for post-exploitation behaviors and lateral movement attempts

Monitoring Recommendations

• Monitor GLPI web server logs for requests containing SQL keywords such as UNION, SELECT, DROP, or encoded equivalents
• Set up alerts for database errors that may indicate SQL injection probing attempts
• Track database user activity for unauthorized data access patterns
• Review network traffic for large data transfers from the GLPI database server

How to Mitigate CVE-2025-32786

Immediate Actions Required

• Upgrade the GLPI Inventory Plugin to version 1.5.1 or later immediately
• Restrict network access to GLPI installations, limiting exposure to trusted networks only
• Review database logs for evidence of exploitation and conduct forensic analysis if suspicious activity is detected
• Implement Web Application Firewall rules to block common SQL injection attack patterns

Patch Information

The GLPI development team has released version 1.5.1 of the Inventory Plugin which addresses this SQL Injection vulnerability. Administrators should download and apply this update as soon as possible. The fix is documented in the GLPI Plugin Changelog and the update is available from the GLPI Plugin Release 1.5.1 page.

Workarounds

• Place GLPI behind a reverse proxy with SQL injection filtering capabilities until patching is possible
• Implement network segmentation to limit database server exposure and restrict connections to authorized application servers only
• Apply database user permission hardening to limit the scope of potential data access
• Consider temporarily disabling vulnerable plugin functionality if the update cannot be immediately applied

# Verify GLPI Inventory Plugin version
grep -r "version" /path/to/glpi/plugins/inventory/setup.php

# Update plugin to patched version 1.5.1
cd /path/to/glpi/plugins
rm -rf inventory
wget https://github.com/glpi-project/glpi-inventory-plugin/releases/download/1.5.1/glpi-inventory-1.5.1.tar.gz
tar -xzf glpi-inventory-1.5.1.tar.gz