CVE-2022-31056: 
GLPI vulnerability analysis and mitigation

GLPI, a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing, was found to contain a SQL injection vulnerability (CVE-2022-31056) in version 10.0.0 and later versions before 10.0.2. The vulnerability was discovered in June 2022 and affects all assistance form (Ticket/Change/Problem) components through the actor fields (GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 9.1 (Critical) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L. The attack vector is Network-based, requires Low complexity and Low privileges, and needs No user interaction. The scope is Changed, with High impact on Confidentiality and Low impact on both Integrity and Availability. The vulnerability is classified as CWE-89 (SQL Injection) (GitHub Advisory).

The SQL injection vulnerability allows attackers to potentially access and manipulate the database through the actor fields in assistance forms. Given the Critical CVSS score and High confidentiality impact, this could lead to unauthorized access to sensitive data stored in the GLPI database (GitHub Advisory).

The vulnerability has been patched in GLPI version 10.0.2. Users are strongly advised to upgrade to this version or later to address the security issue (GitHub Advisory).