CVE-2024-45608
📋 TL;DR
This SQL injection vulnerability in GLPI allows authenticated users to execute arbitrary SQL commands by manipulating their preference settings. The attack requires valid user credentials but can lead to data theft, modification, or deletion. All GLPI instances running vulnerable versions are affected.
💻 Affected Systems
- GLPI
📦 What is this software?
Glpi by Glpi Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including exfiltration of sensitive data, privilege escalation to administrative access, or complete system takeover through SQL injection leading to remote code execution.
Likely Case
Unauthorized access to sensitive information stored in the database, including user credentials, asset details, and configuration data that could enable further attacks.
If Mitigated
Limited impact due to proper input validation, database permissions restrictions, and network segmentation preventing lateral movement.
🎯 Exploit Status
Exploitation requires authenticated access but the SQL injection technique is straightforward once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.17
Vendor Advisory: https://github.com/glpi-project/glpi/security/advisories/GHSA-67p8-v79j-jp86
Restart Required: No
Instructions:
1. Backup your GLPI database and files. 2. Download GLPI 10.0.17 or newer from the official repository. 3. Follow the GLPI upgrade documentation to update your installation. 4. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Input Validation Enhancement
allImplement additional input validation for user preference parameters
Database Permission Restriction
allLimit database user permissions to SELECT only for non-administrative functions
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SQL injection patterns
- Restrict user access to only necessary functions and implement principle of least privilege
🔍 How to Verify
Check if Vulnerable:
Check GLPI version via the web interface (Setup > General > Information) or by examining the GLPI installation files.Check Version:
Check GLPI web interface or examine inc/config.php for version informationVerify Fix Applied:
Confirm version is 10.0.17 or higher and test user preference functionality for SQL injection attempts.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple preference update attempts from single user
- Error messages containing SQL syntax
Network Indicators:
- Unusual database connection patterns
- Large data transfers from database server
SIEM Query:
source="glpi_logs" AND (message="*SQL*" OR message="*syntax*" OR message="*preference*")