Key points
- GLPI versions through 11.0.8 contain an unauthenticated SQL injection vulnerability.
- Attackers can exploit this flaw remotely without needing valid user credentials.
- The vulnerability was reported on the r/netsec subreddit by user MobetaSec.
An unauthenticated SQL injection vulnerability has been identified in GLPI, affecting versions up to and including 11.0.8. This security flaw allows remote attackers to execute arbitrary SQL commands against the underlying database without requiring any form of authentication or prior access to the application.
What happened
The vulnerability was reported on the r/netsec subreddit by user MobetaSec. The submission highlights that the flaw exists in GLPI versions through 11.0.8, leaving these installations exposed to remote exploitation. The report indicates that the injection point is accessible without authentication, meaning an attacker does not need to compromise a user account to initiate the attack. This significantly lowers the barrier for exploitation compared to authenticated flaws.
Why it matters
SQL injection flaws are among the most severe web application vulnerabilities due to their potential impact on data integrity and confidentiality. Because this specific issue in GLPI is unauthenticated, any organisation running affected versions exposes its database directly to the internet if the service is publicly accessible. Attackers can potentially read, modify, or delete data within the database. The lack of required credentials means automated scanning tools can easily identify and exploit this weakness.
What happens next
Security teams should immediately inventory their GLPI installations to determine if they are running versions 11.0.8 or earlier. Since no official patch status is confirmed in the source material, organisations must assess their exposure levels by checking if the GLPI interface is accessible from untrusted networks. If the service is internet-facing, immediate network-level restrictions should be applied to limit access to trusted IP addresses only. Teams should monitor for unusual database activity while awaiting further information.
Patch priority
Organisations should prioritise updating systems that are directly exposed to the internet or untrusted networks. Begin by isolating vulnerable instances behind strict firewall rules or web application firewalls to mitigate immediate risk. Test any available mitigation strategies in a non-production environment before applying them broadly. Ensure that backups of both the application and its database are current and verified. Communicate with stakeholders about potential service disruptions during the mitigation process. Monitor vendor channels closely for an official security advisory and patch release.
What to do and how to stay safe: GLPI
- Verify the version of GLPI installed on all servers and identify any instances running 11.0.8 or earlier.
- Restrict network access to the GLPI application so that only trusted internal IP addresses can reach the service.
- Monitor database logs for unusual query patterns or unexpected administrative actions that may indicate exploitation.
- Prepare to apply a vendor-provided update immediately upon its release, testing it in a staging environment first.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of GLPI are affected by this SQL injection vulnerability?
GLPI versions through 11.0.8 are affected by this unauthenticated SQL injection flaw.
Is a patch available to fix this vulnerability?
The source material does not confirm the availability of a patch or fix.
Does an attacker need to log in to exploit this flaw?
No, the vulnerability is unauthenticated, allowing remote exploitation without valid credentials.
