The GLPI Inventory Plugin contains a critical SQL injection vulnerability in versions 1.5.0 and below, posing a significant risk of unauthorized data exposure.

This vulnerability is a classic SQL injection flaw (CWE-89) triggered by improper neutralization of special elements within SQL commands. The vulnerability is exploitable by an unauthenticated attacker over the network, as indicated by the CVSS vector AV:N/PR:N/UI:N.

Successful exploitation of this SQL injection vulnerability allows an attacker to execute arbitrary queries against the underlying database. This can lead to the unauthorized disclosure of sensitive inventory data, system configurations, or user information, directly impacting data confidentiality. Given the CVSS score of 7.5, this is a high-severity issue that requires immediate attention to prevent potential data breaches.

Immediate Action: Update the GLPI Inventory Plugin to version 1.5.1 or later to resolve the underlying code defect.

Proactive Monitoring: Inspect application and database logs for suspicious SQL syntax, such as unexpected UNION statements or syntax errors, which may indicate automated scanning or exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns to provide temporary protection while the update is staged.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing the GLPI Inventory Plugin must prioritize this update as part of their next maintenance cycle. Because the vulnerability allows unauthenticated access to database contents, failing to patch exposes the environment to significant information disclosure risks. Verify the plugin version immediately and apply the 1.5.1 update to remediate this risk effectively.