CVE-2024-27096

Deeper analysis

GLPI, an open-source IT asset management and service desk platform, contains a SQL injection vulnerability in its search engine component. An authenticated user can supply crafted input that is improperly sanitized before being executed against the backend database, enabling extraction of arbitrary data. The flaw is tracked as CWE-89 and carries a CVSS 3.1 score of 7.7, reflecting network attack vector, low complexity, and high confidentiality impact across security contexts.

An attacker who already possesses a valid GLPI account can leverage the search functionality to read sensitive records from the database without further user interaction. Successful exploitation yields disclosure of information such as user credentials, asset details, or configuration data stored by the application, but does not directly permit modification or denial-of-service conditions.

The project has released version 10.0.13 to address the issue. Official advisories and commits on GitHub document the patch that corrects the input handling in the search engine, and administrators are advised to upgrade from earlier releases.

EPSS scores for the CVE have remained near 0.16 with only marginal fluctuation between the observed peak and current values, indicating moderate but stable exploitation interest since disclosure.