CVE-2025-66417: 
GLPI vulnerability analysis and mitigation

CVE-2025-66417 is an unauthenticated SQL injection vulnerability in GLPI, a free open-source asset and IT management software package. It affects GLPI versions 11.0.0 through 11.0.2, allowing unauthenticated remote attackers to inject malicious SQL commands via the inventory endpoint. The vulnerability was published on January 15, 2026, and patched in version 11.0.3. NVD assigns a CVSS v3.1 base score of 9.8 (Critical), while the GitHub Security Advisory rates it 7.5 (High) with confidentiality-only impact (GitHub Advisory, Red Hat CVE).

The root cause is improper neutralization of special elements in SQL commands (CWE-89), where user-supplied input to the GLPI inventory endpoint is not adequately sanitized before being incorporated into database queries. Because the vulnerable endpoint is accessible without authentication, an attacker can craft malicious HTTP requests containing SQL injection payloads targeting this endpoint without any prior credentials or session. The attack requires no user interaction and has low complexity, making it straightforward to exploit remotely. A public proof-of-concept has been published on GitHub by the credited reporter (GitHub Advisory, PoC Repository).

Successful exploitation allows an unauthenticated attacker to read sensitive data from the GLPI database, potentially exposing asset inventory records, IT management data, user credentials, and other confidential information stored within the application. The GitHub advisory scores this as a confidentiality-only impact (High), while NVD's scoring also includes high integrity and availability impact, reflecting potential for broader database manipulation depending on the database user's privileges. In environments where GLPI is internet-facing, this vulnerability poses a significant risk of mass data exfiltration without any authentication barrier (GitHub Advisory, Red Hat CVE).

A public proof-of-concept exploit has been published on GitHub (credited to researcher 'lem0naids') and indexed on Sploitus, indicating the vulnerability is weaponizable with minimal effort (PoC Repository, Sploitus). A second PoC repository has also appeared on GitHub. As of the available intelligence, there is no confirmed evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.113%, indicating a currently low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog at this time. Nessus detection plugin 297687 is available for scanning (Tenable).

1. Reconnaissance: Identify internet-facing GLPI instances running versions 11.0.0–11.0.2 using search engines like Shodan or Censys, or by fingerprinting the GLPI login page and version disclosure.
2. Locate the inventory endpoint: Target the GLPI inventory endpoint, which is accessible without authentication in affected versions.
3. Craft SQL injection payload: Construct a malicious HTTP request (e.g., POST or GET) to the inventory endpoint, embedding SQL injection syntax in a vulnerable parameter to manipulate the underlying SQL query.
4. Extract database contents: Use techniques such as UNION-based, error-based, or blind SQL injection to enumerate database tables and extract sensitive data including user credentials, asset records, and configuration details.
5. Leverage extracted data: Use obtained credentials or sensitive information for further access to GLPI or connected systems (GitHub Advisory, PoC Repository).

• Network: Unusual or malformed HTTP requests to the GLPI inventory endpoint from unexpected source IPs, particularly containing SQL metacharacters (e.g., ', --, UNION, SELECT, OR 1=1) in request parameters.
• Logs: GLPI or web server access logs showing repeated unauthenticated requests to the inventory endpoint with anomalous parameter values; database error messages logged by the application.
• Database: Unexpected queries in database slow query logs or audit logs involving UNION SELECT statements or unusual data extraction patterns originating from the GLPI application user.
• Application: Sudden spikes in inventory endpoint traffic from a single IP or IP range without corresponding authenticated sessions.

The primary remediation is to upgrade GLPI to version 11.0.3 or later, which contains the fix for this vulnerability (GitHub Advisory). Organizations unable to patch immediately should implement network-level access controls (e.g., firewall rules, WAF policies) to restrict access to the GLPI inventory endpoint to trusted IP addresses only. Given the availability of public PoC code and the unauthenticated nature of the vulnerability, patching should be treated as a high priority. Questions can be directed to the GLPI security team at glpi-security@ow2.org.

The vulnerability received attention from security community social media accounts including TheHackerWire on Mastodon, Infosec.exchange, and Bluesky shortly after disclosure. The GLPI project forum also published a thread referencing the advisory. Red Hat tracked the CVE in their security database. Overall community reaction reflects concern given the unauthenticated nature and the rapid appearance of public PoC code (GLPI Forum, Red Hat CVE).