CVE-2025-21619
📋 TL;DR
This SQL injection vulnerability in GLPI allows administrator users to execute arbitrary SQL commands through rules configuration forms. Attackers with admin access can potentially read, modify, or delete database content. Only GLPI instances with administrator accounts are affected.
💻 Affected Systems
- GLPI
📦 What is this software?
Glpi by Glpi Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or remote code execution via database functions.
Likely Case
Administrator account compromise leading to sensitive data exposure, privilege escalation, or system takeover.
If Mitigated
Limited impact if proper access controls restrict admin privileges and network segmentation is in place.
🎯 Exploit Status
Exploitation requires administrator credentials. SQL injection through web interface forms.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.18
Vendor Advisory: https://github.com/glpi-project/glpi/security/advisories/GHSA-pcmc-xv3g-hjxv
Restart Required: No
Instructions:
1. Backup your GLPI database and files. 2. Download GLPI 10.0.18 or newer from official sources. 3. Follow GLPI upgrade documentation. 4. Verify upgrade completed successfully.
🔧 Temporary Workarounds
Restrict Administrator Access
allLimit administrator accounts to only trusted personnel and implement strong authentication controls.
Network Segmentation
allPlace GLPI instance behind firewall with restricted access to admin interface.
🧯 If You Can't Patch
- Implement strict access controls for administrator accounts with multi-factor authentication.
- Deploy web application firewall with SQL injection protection rules.
🔍 How to Verify
Check if Vulnerable:
Check GLPI version via web interface or by examining the GLPI installation files.Check Version:
Check GLPI web interface footer or examine inc/define.php file for version constant.Verify Fix Applied:
Confirm GLPI version is 10.0.18 or newer via web interface or version file.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts to admin accounts
- Unexpected configuration changes in rules forms
Network Indicators:
- Unusual database connection patterns
- SQL error messages in HTTP responses
SIEM Query:
Search for SQL keywords in POST requests to GLPI rules configuration endpoints.