CVE-2026-22821
📋 TL;DR
The mreporting GLPI plugin before version 1.9.4 contains a SQL injection vulnerability in date change functionality. This allows authenticated attackers to execute arbitrary SQL commands on the database. Organizations using vulnerable versions of this plugin are affected.
💻 Affected Systems
- mreporting GLPI plugin
📦 What is this software?
More Reporting by Glpi Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or full system takeover via SQL injection chaining.
Likely Case
Unauthorized data access, privilege escalation, or data manipulation within the GLPI database.
If Mitigated
Limited impact due to proper input validation and database permissions restricting damage scope.
🎯 Exploit Status
SQL injection vulnerabilities are commonly exploited, but this requires authenticated access to the GLPI interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9.4
Vendor Advisory: https://github.com/pluginsGLPI/mreporting/security/advisories/GHSA-24q7-h59q-33w8
Restart Required: No
Instructions:
1. Backup your GLPI installation and database. 2. Update the mreporting plugin to version 1.9.4 or later via the GLPI plugin interface or manual installation. 3. Verify the update was successful by checking the plugin version.
🔧 Temporary Workarounds
Disable mreporting plugin
allTemporarily disable the vulnerable plugin until patching is possible
Navigate to GLPI Setup > Plugins > Disable mreporting
Restrict user permissions
allLimit access to mreporting functionality to only essential users
Adjust user profiles in GLPI to remove mreporting access
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SQL injection patterns
- Restrict database user permissions to minimum required for application functionality
🔍 How to Verify
Check if Vulnerable:
Check mreporting plugin version in GLPI: Setup > Plugins > mreportingCheck Version:
Check GLPI interface: Setup > Plugins > mreporting shows version 1.9.4+Verify Fix Applied:
Confirm mreporting plugin version is 1.9.4 or higher in GLPI plugin management📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by mreporting access
- Unexpected database errors in application logs
Network Indicators:
- Unusual SQL patterns in HTTP POST requests to mreporting endpoints
SIEM Query:
source="glpi_logs" AND ("mreporting" AND ("SQL" OR "database error" OR "syntax error"))