The GLPI Inventory Plugin for GLPI contains an SQL injection vulnerability that allows authenticated users to potentially compromise sensitive database information.

This vulnerability is an improper neutralization of special elements used in an SQL command (CWE-89). It allows an authenticated user with adequate rights to inject malicious SQL commands through reports due to insufficient input sanitization.

Successful exploitation of this vulnerability could lead to unauthorized data extraction or modification within the GLPI database. With a CVSS score of 7.1, the vulnerability poses a high risk to data confidentiality and integrity, potentially exposing sensitive inventory and network discovery data managed by the plugin.

Immediate Action: Update the GLPI Inventory Plugin to version 1.6.6 or later immediately to apply the vendor-provided patch.

Proactive Monitoring: Review application and database access logs for suspicious query patterns or unusual SQL syntax originating from the reporting module.

Compensating Controls: Implement strict role-based access control (RBAC) to limit the number of users with permissions to access report-generating features until the patch is deployed.

Public Exploit Available: No

Given the potential for SQL injection to facilitate unauthorized data access, administrators should prioritize updating the GLPI Inventory Plugin to version 1.6.6. While the vulnerability requires existing privileges, the impact on organizational data integrity necessitates prompt remediation to prevent exploitation by malicious insiders or compromised accounts.