GLPI versions 11.0.0 through 11.0.5 are vulnerable to an unauthenticated SQL injection attack, posing a significant risk of data compromise and system integrity loss.

This is a time-based blind SQL injection vulnerability (CWE-89) located within the application search engine. The vulnerability allows an unauthenticated attacker to execute arbitrary SQL commands by manipulating input parameters, resulting in a high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthorized party to bypass authentication and interact directly with the underlying database. Given the CVSS score of 8.1, this represents a high-severity risk that could lead to the exfiltration of sensitive asset management data, modification of system configurations, or complete service disruption.

Immediate Action: Upgrade the GLPI installation to version 11.0.6 or later to apply the official security patch provided by the vendor.

Proactive Monitoring: Review database query logs for unusual time delays or anomalous SQL syntax patterns that may indicate automated injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection payloads targeting search parameters.

Public Exploit Available: Unknown.

This vulnerability presents a high risk to administrative and asset management infrastructure. Organizations should prioritize updating their GLPI environment to version 11.0.6 immediately to eliminate the underlying SQL injection flaw and prevent potential unauthorized database access.