CVE-2020-15226: 
GLPI vulnerability analysis and mitigation

In GLPI before version 9.5.2, there exists a SQL Injection vulnerability in the API's search function. The vulnerability (CVE-2020-15226) was discovered and disclosed on October 7, 2020. The issue affects GLPI versions greater than 9.1 and allows an attacker with API access to perform SQL injection attacks through the search functionality (GitHub Advisory).

The vulnerability exists in the search function of GLPI's API where input values were not properly sanitized. An attacker could utilize UNION SELECT queries to extract sensitive information such as the current database version or database user. The vulnerability received a CVSS v3.1 base score of 4.3 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability allows an attacker with API access to break SQL syntax and execute UNION SELECT queries to extract sensitive information from the database. This could lead to unauthorized access to database information such as version numbers, user details, and other sensitive data (GitHub Advisory).

The most likely exploitation scenario involves users who have API account access to the system. However, if an organization generates tickets via the API accepting user input, it could allow users to execute SQL injection without having direct API credentials. A proof-of-concept exploit has been demonstrated using Python (GitHub Advisory).

The vulnerability has been patched in GLPI version 9.5.2. For users unable to upgrade immediately, suggested workarounds include disabling the API or adding temporary application tokens to prevent users from testing the API without knowing the application token (GitHub Advisory).