CVE-2024-40638

Multiple SQL injection vulnerabilities (CWE-89) exist in GLPI, a free and open-source IT asset management platform. The flaws are triggered by an authenticated user with low privileges sending crafted input to the affected application, requiring no user interaction. Successful exploitation allows read and modification of database content, and one of the injections can be used to alter another user's account data and take control of that account, potentially yielding higher-privileged access. Any organization running GLPI prior to version 10.0.17 is affected. No exploitation has been confirmed yet (no public PoC, not in CISA KEV), but the elevated EPSS score of 37.2% (98th percentile) indicates a significant likelihood of exploitation within the next 30 days.

What to do: Upgrade GLPI to version 10.0.17 immediately, as this release fixes all reported SQL injection issues. If immediate upgrade is not possible, review user accounts for unauthorized modifications, monitor logs for suspicious database queries or account changes, and restrict privileges of low-privileged users who can reach the affected functionality.