CVE-2025-25192
📋 TL;DR
CVE-2025-25192 allows low-privileged users in GLPI to enable debug mode, potentially exposing sensitive system information. This affects GLPI installations before version 10.0.18. The vulnerability could reveal configuration details, database credentials, or other sensitive data.
💻 Affected Systems
- GLPI
📦 What is this software?
Glpi by Glpi Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain access to sensitive configuration data, database credentials, or other critical system information leading to full system compromise.
Likely Case
Unauthorized users access debug information containing system details, configuration parameters, or partial sensitive data.
If Mitigated
Limited information disclosure with no critical credentials exposed due to proper access controls and monitoring.
🎯 Exploit Status
Requires low-privileged user access. Exploitation is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.18
Vendor Advisory: https://github.com/glpi-project/glpi/security/advisories/GHSA-86cx-hcfc-8mm8
Restart Required: No
Instructions:
1. Backup your GLPI installation and database. 2. Download GLPI 10.0.18 from official sources. 3. Follow GLPI upgrade documentation to update to version 10.0.18. 4. Verify the update was successful.
🔧 Temporary Workarounds
Remove vulnerable file
linuxDelete the install/update.php file to prevent exploitation
rm /path/to/glpi/install/update.php
Restrict file permissions
linuxSet restrictive permissions on install/update.php
chmod 000 /path/to/glpi/install/update.php
🧯 If You Can't Patch
- Implement strict access controls and monitor low-privileged user activities
- Regularly audit and review user permissions and access patterns
🔍 How to Verify
Check if Vulnerable:
Check GLPI version in administration panel or via version file. Versions below 10.0.18 are vulnerable.Check Version:
cat /path/to/glpi/inc/define.php | grep 'GLPI_VERSION'Verify Fix Applied:
Verify GLPI version is 10.0.18 or higher in administration panel. Check that install/update.php is either patched or removed.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to install/update.php
- Debug mode activation by non-admin users
- Unusual file access patterns in GLPI logs
Network Indicators:
- HTTP requests to /glpi/install/update.php from low-privileged accounts
SIEM Query:
source="glpi_logs" AND (uri="/install/update.php" OR message="debug mode") AND user_role="low_privileged"🔗 References
- https://github.com/glpi-project/glpi/releases/tag/10.0.18
- https://github.com/glpi-project/glpi/security/advisories/GHSA-86cx-hcfc-8mm8
- https://www.vicarius.io/vsociety/posts/cve-2025-25192-detection-glpi-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2025-25192-mitigation-glpi-vulnerability
