CVE-2026-11321 Overview
CVE-2026-11321 is an authenticated SQL injection vulnerability in the DataInjection plugin for GLPI version 2.15.6 (GLPI 11 builds). The plugin concatenates user-supplied CSV field values directly into SQL queries during CSV import operations. It does not parameterize or escape the input, allowing an authenticated user with access to the Data injection feature to inject arbitrary SQL. Attackers can embed expressions such as SLEEP() into mapped fields like Serial Number to extract database contents via time-based blind injection. The vulnerability is tracked under CWE-89 and was addressed in the 2.15.7 release of the plugin.
Critical Impact
Authenticated attackers can extract sensitive database contents from GLPI installations by injecting SQL expressions into mapped CSV fields during data import.
Affected Products
- GLPI DataInjection plugin version 2.15.6
- GLPI 11 builds using the DataInjection plugin
- All installations exposing the Data injection feature to authenticated users
Discovery Timeline
- 2026-07-10 - CVE-2026-11321 published to NVD
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2026-11321
Vulnerability Analysis
The DataInjection plugin processes CSV import files by mapping columns to GLPI asset fields. During this operation, the plugin builds SQL queries by directly concatenating the raw CSV cell values into query strings. No prepared statements, parameter binding, or input escaping is applied to the mapped values before they reach the database layer.
An authenticated user who can access the Data injection feature can craft a CSV file where a mapped field, such as Serial Number, contains an SQL fragment instead of legitimate asset data. When the plugin processes the row, the injected SQL becomes part of the executed query. This allows the attacker to alter query logic, exfiltrate data, and enumerate schema contents. Because the plugin does not return direct query results to the user interface, exploitation typically relies on time-based blind techniques using functions like SLEEP() to infer data one bit at a time.
Root Cause
The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The CSV import handler treats mapped field values as trusted content and inserts them directly into query strings without parameterization or escaping.
Attack Vector
Exploitation requires network access to the GLPI web interface and authenticated credentials with permission to use the Data injection feature. The attacker uploads a malicious CSV file containing SQL payloads in one or more mapped fields. The plugin executes the crafted query against the underlying database on behalf of the attacker.
No verified proof-of-concept exploit is publicly available. Refer to the GitHub Security Advisory GHSA-57qv-j6r6-pcc4 and the VulnCheck Security Advisory for further technical detail.
Detection Methods for CVE-2026-11321
Indicators of Compromise
- CSV import files containing SQL keywords such as SLEEP, UNION, SELECT, BENCHMARK, or comment sequences like -- and /* in fields such as Serial Number, Name, or Inventory Number.
- Database queries generated by the DataInjection plugin with abnormal execution durations, especially recurring multi-second delays consistent with time-based blind injection.
- Web server access logs showing repeated POST requests to the DataInjection plugin endpoints from a single authenticated session.
Detection Strategies
- Enable SQL query logging on the GLPI database and alert on queries originating from the DataInjection plugin that contain SQL control keywords inside string literals.
- Inspect CSV files uploaded to the plugin for non-alphanumeric payloads or database function names before processing.
- Correlate authenticated GLPI sessions with unusually long-running database queries to identify potential time-based extraction.
Monitoring Recommendations
- Monitor GLPI audit logs for repeated use of the Data injection feature by non-administrator accounts.
- Track database process lists for queries exceeding baseline execution times during CSV import operations.
- Review authentication logs for accounts newly granted access to the Data injection feature.
How to Mitigate CVE-2026-11321
Immediate Actions Required
- Upgrade the DataInjection plugin to version 2.15.7 or later, available from the official release page.
- Restrict access to the Data injection feature to trusted administrative accounts only.
- Audit recent CSV imports for suspicious content in mapped fields and review database logs for signs of exploitation.
Patch Information
The maintainers released version 2.15.7 of the DataInjection plugin to address CVE-2026-11321. The fix introduces proper handling of user-supplied CSV field values so they can no longer alter SQL query structure. Details are published in the GitHub Security Advisory GHSA-57qv-j6r6-pcc4.
Workarounds
- Disable the DataInjection plugin until the patched version can be deployed.
- Remove the Data injection permission from all non-administrative GLPI profiles.
- Enforce pre-processing of CSV imports to reject files containing SQL keywords or non-printable characters in mapped fields.
# Example: verify installed DataInjection plugin version in GLPI
grep -R "version" /var/www/glpi/plugins/datainjection/setup.php
# Upgrade by replacing the plugin directory with the 2.15.7 release
cd /var/www/glpi/plugins
rm -rf datainjection
curl -L -o datainjection-2.15.7.tar.gz \
https://github.com/pluginsGLPI/datainjection/releases/download/2.15.7/glpi-datainjection-2.15.7.tar.gz
tar -xzf datainjection-2.15.7.tar.gz
chown -R www-data:www-data datainjection
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
