CVE-2025-24799

GLPI, a widely used open-source IT asset and service management platform, contains an unauthenticated SQL injection flaw (CWE-89) in its inventory endpoint. An attacker can trigger it by sending specially crafted, unauthenticated requests to that endpoint, causing attacker-controlled input to be executed within SQL queries. Successful exploitation could allow reading or modifying the GLPI database, exposing sensitive IT asset and configuration data and potentially further access, consistent with the critical 9.8 CVSS score (high confidentiality, integrity and availability impact). Any GLPI deployment running a version earlier than 10.0.18 is affected, particularly instances whose inventory endpoint is reachable by untrusted clients. A public proof-of-concept exists and the flaw is not yet in CISA's KEV, but EPSS assigns an 86.3% probability of exploitation within 30 days (100th percentile), indicating elevated exploitation risk.

What to do: Upgrade to GLPI 10.0.18 or later immediately, prioritizing instances whose inventory endpoint is exposed to untrusted networks or the internet. If patching must be delayed, restrict access to the inventory endpoint (e.g., limit to known agent source IPs or internal networks) and review logs for anomalous or unauthenticated inventory requests. Note that exploitation requires no authentication or user interaction, so do not rely on access controls alone.