Critical · published April 5, 2023
🚨 A crafty SQL Injection lets users with access rights pull ALL data from your GLPI server — it’s like handing a key to the vault without even checking who’s knocking! 🔥 Imagine if your friendly neighborhood café had an open back door, allowing anyone with a badge to walk in and access the entire inventory — even bake their own special pie! That’s what’s happening here with GLPI’s vulnerability allowing unauthorized data extraction or even a webshell installation. An attacker could extract sensitive database information or, even worse, write a webshell on the server, opening the door to complete server control. It’s absolutely devastating, as malicious actors could wreak havoc on your IT management software and compromise all the assets tied to it, leading to potential data leaks or service disruptions.
Imagine if your friendly neighborhood café had an open back door, allowing anyone with a badge to walk in and access the entire inventory — even bake their own special pie! That’s what’s happening here with GLPI’s vulnerability allowing unauthorized data extraction or even a webshell installation. This SQL Injection vulnerability in GLPI versions 0.50 to 9.5.12 and 10.0.6 allows users with inappropriate access to execute queries against the database, allowing unauthorized data extraction or modifications, including webshell uploads.
An attacker could extract sensitive database information or, even worse, write a webshell on the server, opening the door to complete server control. It’s absolutely devastating, as malicious actors could wreak havoc on your IT management software and compromise all the assets tied to it, leading to potential data leaks or service disruptions. To safeguard your system, update GLPI to version 9.5.13 or 10.0.7 immediately. As a temporary workaround, you can remove read rights for 'Assistance > Statistics' and 'Tools > Reports' from all users to limit access until you've patched. Don't wait — secure your data now! You've got this! Just follow these steps, and you’ll have your GLPI locked down in no time! 🛡️