CVE-2022-31061

Deeper analysis

GLPI, an open-source IT asset management and service desk platform, contains a SQL injection vulnerability (CWE-89) on its unauthenticated login page in affected versions. The flaw permits direct database manipulation without any credentials and carries a CVSS 3.1 score of 9.8, reflecting network-exploitable impact on confidentiality, integrity, and availability.

An attacker can submit crafted input through the login form to execute arbitrary SQL queries, potentially extracting sensitive data, modifying records, or gaining administrative control over the GLPI instance and its underlying database. No prior authentication or user interaction is required, making the issue remotely exploitable by any network-reachable adversary.

The project’s security advisory and associated commits instruct administrators to upgrade immediately to a patched release; no workarounds are documented. The referenced GitHub advisory (GHSA-w2gc-v2gm-q7wq) and fix commit (21ae07d) contain the remediation details.

EPSS for the CVE rose from a low post-disclosure baseline to a peak of 0.5177 in late 2025 before receding to the current value of 0.4591, indicating renewed exploitation interest well after the original 2022 publication.