CVE-2025-66417

Executive Summary

CVE-2025-66417 is a critical unauthenticated SQL injection vulnerability affecting GLPI (Gestionnaire Libre de Parc Informatique), a popular open-source IT asset management software. The flaw resides in the inventory endpoint, allowing a remote, unauthenticated attacker to inject arbitrary SQL commands. Successful exploitation could lead to complete compromise of the GLPI database, including the exfiltration of sensitive asset data, user credentials, and configuration secrets. The vulnerability affects versions 11.0.0 through 11.0.2 and is fixed in version 11.0.3. Given the lack of authentication required and the high potential for data breach, this vulnerability is considered high severity.

Supply Chain & Package Security

GLPI is a PHP application distributed via GitHub and its official website. The vulnerability is introduced in the core application code, not a third-party package. However, organizations using GLPI should verify the integrity of their installation and ensure they are not running a modified or backdoored version. The patch is available in the official GLPI repository.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions or complex attack sequences are required.
• Privileges Required (PR): None (N) - The attacker does not need any authentication.
• User Interaction (UI): None (N) - No user action is required for exploitation.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Full database read access is likely achievable.
• Integrity (I): High (H) - The attacker can modify or delete database records.
• Availability (A): High (H) - The attacker could potentially disrupt the database service.

CVSS Score: 7.5 (High)

Threat Level: Critical. The combination of network accessibility, no authentication, and high impact makes this a top-priority vulnerability for patching.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection (CWE-89) in the inventory endpoint of GLPI. The inventory endpoint is used by agents (like FusionInventory) to submit hardware and software inventory data. The flaw likely stems from insufficient sanitization of user-supplied input within the inventory processing logic. An attacker can craft a malicious HTTP request to the inventory endpoint, injecting SQL commands into parameters that are directly concatenated into SQL queries.

The injection point is likely within a parameter that is used to identify the device or agent, such as a device ID, tag, or a custom field. By manipulating this parameter, the attacker can break out of the intended SQL query structure and execute arbitrary SQL statements.

Example Attack Flow:

1. The attacker sends a POST request to /front/inventory.php (or similar endpoint) with a crafted payload.
2. The payload contains a SQL injection string, e.g., ' OR 1=1 -- -.
3. The vulnerable code constructs a SQL query like: SELECT * FROM glpi_inventory WHERE device_id = '$input'.
4. The injected string modifies the query to: SELECT * FROM glpi_inventory WHERE device_id = '' OR 1=1 -- -'.
5. This returns all records from the table, bypassing the intended filter.

The attacker can then use UNION-based or blind SQL injection techniques to extract data from other tables, such as glpi_users (for credentials), glpi_configs (for secrets), or glpi_entities (for organizational data).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In inventory processing logic
$device_id = $_POST['device_id'];
$query = "SELECT * FROM glpi_inventory WHERE device_id = '$device_id'";
$result = $DB->query($query);

Patched Code (Conceptual):

// In inventory processing logic
$device_id = $_POST['device_id'];
$query = "SELECT * FROM glpi_inventory WHERE device_id = ?";
$stmt = $DB->prepare($query);
$stmt->bind_param("s", $device_id);
$stmt->execute();
$result = $stmt->get_result();

The patch replaces direct string interpolation with parameterized queries (prepared statements), which prevents SQL injection by separating SQL code from data.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable GLPI instance (version 11.0.0 to 11.0.2) using Docker:

   docker run -d -p 80:80 --name glpi-vuln glpi/glpi:11.0.2
   

2. Access the GLPI web interface and complete the initial setup.

Exploitation Steps:

1. Identify the vulnerable endpoint. Based on the description, it is likely related to the inventory submission. Common endpoints include /front/inventory.php or /plugins/fusioninventory/front/inventory.php.
2. Use a tool like sqlmap to automate the exploitation:

   sqlmap -u "http://target.com/front/inventory.php" --data="device_id=1" --batch --dbs
   

3. If manual exploitation is preferred, craft a payload:

   POST /front/inventory.php HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   device_id=1' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100-- -
   

4. Adjust the number of columns based on the table structure. Use error-based or blind techniques to extract data.

Blue Team (Defensive)

Detection:

• Monitor for unusual SQL errors in application logs (e.g., You have an error in your SQL syntax).
• Look for HTTP requests to inventory endpoints with suspicious parameters containing SQL keywords (UNION, SELECT, OR, --, #).
• Use a Web Application Firewall (WAF) to block common SQL injection patterns.

Hunting:

• Search for requests to /front/inventory.php or /plugins/fusioninventory/front/inventory.php with non-standard parameters.
• Analyze database logs for queries that deviate from the expected pattern (e.g., queries with OR 1=1 or UNION SELECT).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /front/inventory.php or /plugins/fusioninventory/front/inventory.php with parameters containing SQL injection patterns.
  • Outbound database connections from the GLPI server to unexpected IP addresses (data exfiltration).
• File IOCs:
  • Modified or new files in the GLPI installation directory (e.g., web shells).
  • Unusual entries in GLPI logs (/var/log/glpi/ or glpi/files/_log/).
• Database IOCs:
  • New user accounts in glpi_users with elevated privileges.
  • Unusual queries in the database query log (if enabled).
  • Modified configuration values in glpi_configs.

Detection Engineering

YARA Rule

rule CVE_2025_66417_GLPI_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting GLPI inventory endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-66417"
    strings:
        $s1 = "/front/inventory.php" ascii wide nocase
        $s2 = "/plugins/fusioninventory/front/inventory.php" ascii wide nocase
        $sqli1 = " UNION " ascii wide nocase
        $sqli2 = " OR " ascii wide nocase
        $sqli3 = " SELECT " ascii wide nocase
        $sqli4 = " -- " ascii wide nocase
        $sqli5 = " #" ascii wide nocase
    condition:
        any of ($s*) and any of ($sqli*)
}

Sigma Rule

title: GLPI SQL Injection Attempt (CVE-2025-66417)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against GLPI inventory endpoint
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/front/inventory.php'
            - '/plugins/fusioninventory/front/inventory.php'
        cs-uri-query|contains|all:
            - 'device_id'
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate inventory submissions with unusual device IDs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"GLPI SQL Injection Attempt (CVE-2025-66417)"; flow:to_server,established; content:"POST"; http_method; content:"/front/inventory.php"; http_uri; nocase; content:"device_id"; http_client_body; pcre:"/(UNION|SELECT|OR\s+1=1|--|#)/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade GLPI to version 11.0.3 or later immediately.
2. WAF Rules: Deploy or update WAF rules to block SQL injection patterns targeting the inventory endpoint.
3. Network Segmentation: Ensure the GLPI server is not directly accessible from the internet. Use a VPN or bastion host for administrative access.

Long-Term Measures:

1. Code Review: Conduct a thorough code review of all input handling in the inventory module to ensure prepared statements are used.
2. Security Testing: Integrate automated SQL injection scanning into the CI/CD pipeline.
3. Monitoring: Enable detailed logging for all database queries and monitor for anomalies.
4. Least Privilege: Ensure the database user used by GLPI has minimal necessary privileges (e.g., no DROP or CREATE permissions).

Workaround (if patching is not immediately possible):

• Disable the inventory endpoint by removing or renaming the vulnerable files (e.g., inventory.php).
• Restrict access to the inventory endpoint via .htaccess or firewall rules to only trusted IP addresses (e.g., inventory agent servers).

Valters IT
Securing Digital Assets with Precision