CVE-2024-56801: Tasklists has Blind SQL Injection in /ajax/reorder.php

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-30 · updated 2026-06-17
Weakness: CWE-89

Description

Tasklists provides plugin tasklists for GLPI. Versions prior to 2.0.4 have a blind SQL injection vulnerability. Version 2.0.4 contains a patch for the vulnerability.

Affected products

InfotelGLPI tasklists: before 2.0.4 — fixed in 2.0.4

How to fix

Upgrade to a fixed version: InfotelGLPI tasklists 2.0.4. Check the vendor advisory for mitigations.

References

https://github.com/InfotelGLPI/tasklists/commit/6444026e3d2b8fb22d5e5ab03fb86056e1ac9e43
https://github.com/InfotelGLPI/tasklists/security/advisories/GHSA-c6fw-xw9x-gwjw

Get alerted when CVE-2024-56801 or the next vulnerability affects your stack