CVE-2025-21619

Executive Summary

CVE-2025-21619 is a critical SQL injection vulnerability discovered in GLPI, a widely used open-source IT asset and service management platform. The flaw resides in the rules configuration forms, allowing an authenticated administrator user to inject arbitrary SQL commands. Successful exploitation could lead to unauthorized data access, modification, or deletion of the underlying database. The vulnerability is fixed in GLPI version 10.0.18. Given the administrative privileges required, the immediate risk is elevated for environments where administrative accounts are compromised or misused.

Supply Chain & Package Security

GLPI is a PHP-based application distributed via GitHub and its official website. The vulnerability is introduced through the application's own codebase, not a third-party package. However, organizations using GLPI should verify the integrity of their installation and ensure they are sourcing the application from official channels to avoid supply chain attacks.

CVSS Breakdown & Threat Level

The CVSS score is currently listed as 0.0, indicating that a full vector has not been assigned by NVD. However, based on the nature of the vulnerability (SQL injection by an authenticated administrator), a reasonable estimated CVSS v3.1 vector would be:

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The attack can be performed remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): High – The attacker must have administrator-level access.
• User Interaction (UI): None – No user action is needed.
• Scope (S): Unchanged – The vulnerability does not affect other components.
• Confidentiality (C): High – Full database read access is possible.
• Integrity (I): High – Data can be modified or deleted.
• Availability (A): High – Database operations can be disrupted.

Threat Level: High (for environments with untrusted administrators or weak admin password policies).

Deep Dive & Mechanics

The vulnerability exists in the rules configuration forms within GLPI. These forms are used to define automated actions based on specific conditions (e.g., ticket assignment, email notifications). The input fields for rule criteria and actions are not properly sanitized before being used in SQL queries.

An administrator can craft a malicious input that breaks out of the intended SQL syntax. For example, a rule condition like name = 'test' OR 1=1 -- - could be injected into a WHERE clause, altering the query's logic. The exact vulnerable endpoint is likely in the Rule class or its associated controllers, where user-supplied data is concatenated directly into SQL statements.

The fix in version 10.0.18 involves parameterizing the SQL queries or properly escaping user input, preventing injection.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In a Rule class method
$query = "SELECT * FROM glpi_rules WHERE name = '" . $_POST['rule_name'] . "'";
$result = $DB->query($query);

Patched Code (Conceptual):

// Using prepared statements
$stmt = $DB->prepare("SELECT * FROM glpi_rules WHERE name = ?");
$stmt->bind_param("s", $_POST['rule_name']);
$stmt->execute();
$result = $stmt->get_result();

The patched version uses parameterized queries, which separate SQL logic from data, making injection impossible.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable GLPI instance (version < 10.0.18) using Docker:

   docker run -d -p 80:80 --name glpi-vuln glpi/glpi:10.0.17
   

2. Access the web interface and log in as an administrator.
3. Navigate to Administration > Rules and select any rule type (e.g., Ticket rules).

Exploitation Steps:

1. In the rule creation form, inject SQL into a text field (e.g., "Name" or "Condition").
2. Example payload for a rule name:

   '; DROP TABLE glpi_tickets; --
   

3. Submit the form. The injected SQL will execute, potentially dropping the tickets table.

Note: This is a proof-of-concept. Actual exploitation requires knowledge of the database schema.

Blue Team

Detection:

• Monitor for unusual SQL errors in GLPI logs (/var/log/glpi/php-errors.log).
• Look for HTTP requests to /front/rule.form.php or similar endpoints with suspicious parameters containing SQL keywords (SELECT, DROP, UNION, --).
• Use a Web Application Firewall (WAF) to block SQL injection patterns.

Hunting:

• Search for administrator accounts created or modified around the time of the attack.
• Review database logs for unexpected queries (if enabled).

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /front/rule.form.php with parameters containing SQL syntax.
• Logs: PHP error logs showing SQL syntax errors or failed queries.
• Database: Unexpected entries in glpi_rules table with malicious payloads.
• File System: Modified rule definition files (if any) in the GLPI installation directory.

Detection Engineering

YARA Rule

rule glpi_sqli_rule_form {
    meta:
        description = "Detects SQL injection attempts in GLPI rule form parameters"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-21619"
    strings:
        $sqli1 = /'.*OR.*1=1.*--/i
        $sqli2 = /'.*UNION.*SELECT.*/i
        $sqli3 = /'.*DROP.*TABLE.*/i
        $sqli4 = /'.*INSERT.*INTO.*/i
    condition:
        any of ($sqli*)
}

Sigma Rule

title: GLPI Rule Form SQL Injection Attempt
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts targeting GLPI rule configuration forms
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-21619
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/front/rule.form.php'
    keywords:
        - 'SELECT'
        - 'DROP'
        - 'UNION'
        - '--'
        - '1=1'
    condition: selection and keywords
falsepositives:
    - Legitimate rule names containing these words (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-21619 GLPI Rule Form SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/front/rule.form.php"; http_uri;
    pcre:"/(SELECT|DROP|UNION|1=1|--)/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate:

1. Upgrade GLPI to version 10.0.18 or later.
2. If immediate upgrade is not possible, restrict access to the rule configuration forms to only trusted administrators.
3. Implement a Web Application Firewall (WAF) with SQL injection rules.

Long-term:

1. Enforce strong password policies for administrator accounts.
2. Enable multi-factor authentication (MFA) for all admin users.
3. Regularly audit administrator activities.
4. Keep GLPI and all plugins up to date.

Workaround:

• Disable the rule configuration feature temporarily by removing write permissions on the relevant files (not recommended for production).

Valters IT
Securing Digital Frontiers