CVE-2022-29250: SQL injection in GLPI

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-06-09 · updated 2026-06-17
Weakness: CWE-89

Description

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to version 10.0.1 it is possible to add extra information by SQL injection on search pages. In order to exploit this vulnerability a user must be logged in.

Affected products

glpi-project glpi: 10.0.0, 10.0.0-beta, 10.0.0-rc1, 10.0.0-rc2, 10.0.0-rc3

References

https://github.com/glpi-project/glpi/security/advisories/GHSA-5w33-4wrx-8hvw
https://github.com/glpi-project/glpi/security/advisories/GHSA-5w33-4wrx-8hvw

Get alerted when CVE-2022-29250 or the next vulnerability affects your stack