CVE-2023-43813

Deeper analysis

GLPI, an open-source IT asset management application, contains a SQL injection vulnerability in its saved search feature. The flaw affects all releases from 10.0.0 through 10.0.10 and is tracked as CWE-89. It received a CVSS 3.1 score of 6.5, reflecting network attack vector, low complexity, and low privileges required.

An authenticated user can supply a crafted saved-search payload that is processed without adequate parameterization, allowing the attacker to read arbitrary database contents. Because the injection occurs server-side with no user-interaction requirement, an adversary with a valid account can exfiltrate sensitive configuration or asset data across the network.

The project addressed the issue in version 10.0.11; the corrective commit and corresponding GitHub Security Advisory GHSA-94c3-fw5r-3362 are publicly available. Administrators should upgrade to 10.0.11 or later and verify that the saved-search code path no longer accepts unsanitized input.

EPSS for the CVE currently stands at 0.1147 with a recorded peak of 0.1174; no material post-disclosure climb from a low baseline is evident, and no confirmed in-the-wild exploitation has been reported.