CVE-2025-24799

GLPI allows unauthenticated SQL injection through the inventory endpoint

Published: Mar 18, 2025Updated: Jul 31, 2025 Sources: CVE List NVD BDUCWE-89

7.5HIGH

Description

GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18.

In plain language

AI Act now

GLPI versions before 10.0.18 let an outsider read information from its database, so small businesses using GLPI should update promptly.

Executive summary

Unauthenticated SQL injection (CWE-89) in the GLPI inventory endpoint can expose database contents over the network.

If affected, business impact

IT asset data exposureUser account data exposureConfiguration data exposurePrivacy incident risk

What to do now

Check whether you run GLPI and confirm its installed version.
Upgrade GLPI to version 10.0.18.
If the upgrade must wait, restrict access to the inventory endpoint to trusted systems.
Review database and web-server logs for unusual inventory-endpoint requests.

Patch / advisory Some work to apply

What is it

GLPI is software used to track IT equipment and manage IT work. This flaw is like leaving a back-office filing cabinet open through a service entrance: an outsider may be able to ask for information they should not see.

Who is affected

This matters to you if you use or run GLPI, especially to manage computers, software, users, or support work. It is a risk when the GLPI inventory endpoint is reachable by an attacker over your network.

How urgent is it

This is urgent because an attacker does not need a login to target the vulnerable endpoint. Although CISA has not listed it as actively exploited, the predicted likelihood of attack is extremely high and rising; treat this as a red-priority update.

What to do — in detail

Confirm the deployed GLPI version and identify every instance, including externally reachable production, test, and managed-hosting deployments. Upgrade affected installations to GLPI 10.0.18; the supplied remediation identifies 10.0.18 as the fixed target and does not provide separate branch-specific fixes. Before upgrading, follow the vendor release guidance, back up the application and database, test the update if you have a staging instance, then verify the installed version after deployment.

If patching is delayed, limit the inventory endpoint to known inventory agents or trusted network ranges through the reverse proxy, firewall, or access-control layer; remove broad public access where feasible. No CISA KEV remediation due date applies because this CVE is not listed in KEV. Review web-server and application logs for unexpected requests to the inventory endpoint and investigate unusual database errors or large, unexpected responses.

Technical context

CVE-2025-24799 is rated CVSS 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). It is CWE-89 SQL injection in GLPI's inventory endpoint, with network access, low attack complexity, no privileges, and no user interaction required; the stated impact is high confidentiality with no integrity or availability impact. EPSS predicts an 86.7% likelihood (100th percentile) and is rising. CISA KEV does not list this CVE. Exploit reporting indicates a detection template only, not confirmed weaponized exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:NUser Interaction

None

Scope

S:UScope

Unchanged

Impact

C:HConfidentiality

High

I:NIntegrity

None

A:NAvailability

None

Open in CVSS calculator →

Weaknesses

CWE-89

Affected Products

glpi-project

oss-project·FR

glpiOn-premWeb App

Enterprise Software / itsm-monitoring

GLPI Project

oss-project·FRaka glpi inventory, glpi

GLPIOn-premWeb App

Enterprise Software / itsm-monitoring

Exploitability

Official Patch Available

Is your org exposed to CVE-2025-24799?Discuss checks for your systems with a specialist. Scope agreed before testing. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

1 technique

Initial Access

View detailed technique mapping

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-jv89-g7f7-jwfg

github.com

https://glpi-project.org/glpi-10-0-18-is-available/

glpi-project.org

https://research.kudelskisecurity.com/2025/03/14/pre-authentication-sql-injection-to-rce-in-glpi-cve-2025-24799-cve-2025-24801/

research.kudelskisecurity.com

and 3 more references View all →

News mentions

Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use
en·Cisco Talos·Sep 17, 2026 Exploited The Gentlemen ransomware

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2025-24799 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows