CVE-2025-32786

Executive Summary

CVE-2025-32786 is a critical SQL Injection vulnerability in the GLPI Inventory Plugin, affecting versions 1.5.0 and below. This plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. The vulnerability allows an unauthenticated attacker to execute arbitrary SQL commands against the underlying database, potentially leading to complete compromise of the GLPI instance, including data exfiltration, modification, or deletion. The CVSS score is 7.5 (High), and while the EPSS score is currently 0.0%, the lack of a public proof-of-concept (PoC) does not diminish the severity. The vendor has released a fix in version 1.5.1.

Supply Chain & Package Security

This vulnerability affects the GLPI Inventory Plugin, which is a third-party plugin for the GLPI open-source IT asset management platform. The plugin is distributed through the GLPI marketplace and GitHub. Organizations using GLPI with the Inventory Plugin should treat this as a high-priority supply chain risk, as exploitation could lead to lateral movement within the network.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. The vulnerability is remotely exploitable without authentication, and the impact on confidentiality, integrity, and availability is severe.

Deep Dive & Mechanics

The GLPI Inventory Plugin processes data from GLPI agents during network discovery and inventory tasks. The vulnerability lies in how the plugin handles user-supplied input within SQL queries. Specifically, the plugin fails to properly sanitize or parameterize input passed to database queries, allowing an attacker to inject arbitrary SQL code.

The injection point is likely within the plugin's handling of agent data, such as device names, IP addresses, or custom fields. An attacker can craft a malicious request to the GLPI server that includes SQL injection payloads. When the plugin processes this request, the malicious SQL is executed against the database.

For example, a request to the inventory endpoint might include a parameter like device_name=test' OR '1'='1. If the plugin directly concatenates this into a SQL query, it could result in:

SELECT * FROM glpi_inventory WHERE device_name = 'test' OR '1'='1';

This would return all records, bypassing authentication or access controls.

Vulnerable vs. Patched Code

Vulnerable Code (Version 1.5.0 and below):

The vulnerable code likely uses string concatenation to build SQL queries. For example:

$query = "SELECT * FROM glpi_inventory WHERE device_name = '" . $_POST['device_name'] . "'";
$result = $DB->query($query);

Patched Code (Version 1.5.1):

The patched code uses prepared statements or parameterized queries to prevent SQL injection:

$stmt = $DB->prepare("SELECT * FROM glpi_inventory WHERE device_name = ?");
$stmt->bind_param("s", $_POST['device_name']);
$stmt->execute();
$result = $stmt->get_result();

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable GLPI instance with Inventory Plugin version 1.5.0.
2. Use a tool like sqlmap or manual SQL injection techniques.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /plugins/inventory/ajax/inventory.php).
2. Craft a malicious request with SQL injection payload.
3. Use sqlmap to automate exploitation:

sqlmap -u "http://target/plugins/inventory/ajax/inventory.php?device_name=test" --batch --dbs

4. Extract database contents:

sqlmap -u "http://target/plugins/inventory/ajax/inventory.php?device_name=test" --batch -D glpi --tables

Blue Team

Detection:

• Monitor for unusual SQL errors in application logs.
• Look for requests containing SQL keywords (e.g., UNION, SELECT, OR) in parameters.
• Use WAF rules to block common SQL injection patterns.

Hunting:

• Search for requests to /plugins/inventory/ajax/inventory.php with suspicious parameters.
• Analyze database logs for unexpected queries.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Requests to /plugins/inventory/ajax/inventory.php with parameters containing SQL keywords.
  • Outbound database connections from the GLPI server to unknown IPs.
• File IOCs:
  • Modified or new files in the GLPI installation directory.
  • Suspicious entries in GLPI logs (e.g., /var/log/glpi/php-errors.log).
• System IOCs:
  • Unexpected database users or privileges.
  • New cron jobs or scheduled tasks.

Detection Engineering

YARA Rule

rule CVE_2025_32786_GLPI_SQLI {
    meta:
        description = "Detects SQL injection attempts targeting GLPI Inventory Plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32786"
    strings:
        $s1 = "device_name=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "OR 1=1" nocase
        $s5 = "/plugins/inventory/ajax/inventory.php" nocase
    condition:
        any of ($s*) and #s5 > 0
}

Sigma Rule

title: GLPI Inventory Plugin SQL Injection Attempt
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts targeting CVE-2025-32786
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/plugins/inventory/ajax/inventory.php'
            - 'device_name='
            - 'UNION'
            - 'SELECT'
            - 'OR 1=1'
    condition: selection
falsepositives:
    - Legitimate use of device names containing SQL keywords
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32786 GLPI Inventory Plugin SQL Injection Attempt"; flow:to_server,established; content:"/plugins/inventory/ajax/inventory.php"; http_uri; content:"device_name="; http_uri; pcre:"/(UNION|SELECT|OR\s+1=1)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade the GLPI Inventory Plugin to version 1.5.1 or later.
2. If immediate upgrade is not possible, disable the plugin temporarily.
3. Implement a Web Application Firewall (WAF) with rules to block SQL injection.

Long-term Measures:

• Enforce the use of prepared statements in all plugin development.
• Conduct regular security audits of third-party plugins.
• Monitor for new CVEs related to GLPI and its plugins.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence. For questions or further analysis, contact intelligence@valters-it.com.