CVE-2024-27096: 
GLPI vulnerability analysis and mitigation

CVE-2024-27096 is a SQL injection vulnerability discovered in GLPI, a Free Asset and IT Management Software package used for data center management, ITIL Service Desk, licenses tracking, and software auditing. The vulnerability was disclosed on March 18, 2024, affecting all versions from 0.65 up to (excluding) 10.0.13. This security flaw allows authenticated users to exploit a SQL injection vulnerability in the search engine functionality to extract data from the database (NVD, GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 7.7 (High) by GitHub and 6.5 (Medium) by NIST, with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. The vulnerability is classified as CWE-89 (SQL Injection). The security issue can only be exploited if the GLPI server is using PHP 7.4 (GitHub Advisory).

The vulnerability allows authenticated users to extract data from the database through SQL injection in the search engine functionality. This could lead to unauthorized access to sensitive information stored in the GLPI database (GitHub Advisory).

The vulnerability requires authentication and can only be exploited on systems running PHP 7.4. The attack vector is network-based with low attack complexity, requiring low privileges and no user interaction (GitHub Advisory).

The vulnerability has been patched in GLPI version 10.0.13. Users are recommended to upgrade to this version. As a workaround, users can upgrade their PHP version to 8.0 or higher (GitHub Advisory, GLPI Release).

The GLPI project released version 10.0.13 as a security release, recommending immediate upgrade to address this and several other security issues. The release received positive reactions from the community on GitHub, with 8 users showing appreciation through emoji reactions (GLPI Release).