CVE-2023-36808
📋 TL;DR
This SQL injection vulnerability in GLPI allows attackers to execute arbitrary SQL commands through the Computer Virtual Machine form and inventory request features. All GLPI installations running versions 0.80 through 10.0.7 are affected. Successful exploitation could lead to data theft, modification, or complete system compromise.
💻 Affected Systems
- GLPI
📦 What is this software?
Glpi by Glpi Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise allowing data exfiltration, privilege escalation, and potential remote code execution on the underlying server.
Likely Case
Unauthorized access to sensitive IT asset data, user credentials, and potential lateral movement within the network.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only allowing data viewing without modification.
🎯 Exploit Status
SQL injection vulnerabilities typically have low exploitation complexity, but specific exploit details are not publicly documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.8
Vendor Advisory: https://github.com/glpi-project/glpi/security/advisories/GHSA-vf5h-jh9q-2gjm
Restart Required: No
Instructions:
1. Backup your GLPI database and files. 2. Download GLPI 10.0.8 from official repository. 3. Follow GLPI upgrade documentation to apply the update. 4. Verify the update completed successfully.
🔧 Temporary Workarounds
Disable Native Inventory
allDisable GLPI's native inventory feature to prevent exploitation through inventory requests.
Edit GLPI configuration to disable inventory features
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries at application layer
- Apply network segmentation and restrict access to GLPI instance
🔍 How to Verify
Check if Vulnerable:
Check GLPI version via web interface or by examining version files in installation directory.Check Version:
Check GLPI web interface or examine config/glpicrypt.key file versionVerify Fix Applied:
Verify GLPI version is 10.0.8 or higher and test inventory functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed inventory requests
- Suspicious patterns in web server access logs
Network Indicators:
- Unusual database connection patterns
- Excessive inventory requests from single source
SIEM Query:
Search for patterns like 'UNION SELECT', 'OR 1=1', or other SQL injection attempts in web logs