CVE-2023-28838: 
GLPI vulnerability analysis and mitigation

A SQL Injection vulnerability (CVE-2023-28838) was discovered in GLPI, a free asset and IT management software package. The vulnerability affects versions from 0.50 up to versions 9.5.13 and 10.0.7, allowing users with access rights to statistics or reports to extract all data from the database and potentially write a webshell on the server. The issue was disclosed and patched on April 5, 2023 (GLPI Advisory).

The vulnerability is classified as a SQL Injection (CWE-89) with a CVSS v3.1 base score of 8.1 HIGH according to NVD, while GitHub rates it as 9.6 CRITICAL. The attack vector is Network-based (AV:N) with Low attack complexity (AC:L), requiring Low privileges (PR:L) and No user interaction (UI:N). The scope is rated as Unchanged by NVD but Changed by GitHub, with High impacts on both Confidentiality and Integrity (NVD, GLPI Advisory).

The vulnerability allows authenticated users with access to statistics or reports functionality to extract all data from the database. In some cases, attackers could potentially write a webshell on the server, leading to severe system compromise (GLPI Advisory).

The vulnerability has been patched in GLPI versions 9.5.13 and 10.0.7. As a workaround for unpatched systems, administrators can remove 'Assistance > Statistics' and 'Tools > Reports' read rights from all users (GLPI Release, GLPI Advisory).