A critical SQL injection vulnerability in GLPI allows unauthenticated attackers to query the database, posing a high risk of sensitive information disclosure.

This vulnerability is a SQL injection flaw (CWE-89) located in the inventory endpoint of the application. It allows an unauthenticated remote attacker to inject malicious SQL commands to retrieve sensitive data from the underlying database.

The ability for an unauthenticated user to interact directly with the database poses a significant risk to the confidentiality of organizational data. Given the CVSS score of 7.5, this high-severity flaw could lead to the unauthorized exposure of IT infrastructure details or user credentials stored within the asset management system, resulting in severe data loss or further system compromise.

Immediate Action: Upgrade all instances of GLPI to version 11.0.3 or later to apply the necessary security patches.

Proactive Monitoring: Review web server and application logs for suspicious traffic patterns directed at inventory endpoints, particularly those containing SQL syntax or unusual query parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns until the software can be patched.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub (https://github.com/nflatrea/CVE-2025-66417).

Due to the unauthenticated nature of this vulnerability and the availability of public exploit code, the risk to your environment is significant. Administrators should prioritize the update to version 11.0.3 immediately to eliminate the injection vector and secure the database against unauthorized access.