CVE-2022-31056 SQL injection with _actor parameter in GLPI

What is CVE-2022-31056?

CVE-2022-31056 is a critical SQL injection vulnerability in Glpi-Project Glpi, published on 28 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all assistance forms (Ticket/Change/Problem) permit sql injection on the actor fields. This issue has been resolved in version 10.0.2 and all affected users are advised to upgrade.

Weakness: CWE-89

Which versions are affected by CVE-2022-31056?

It affects 1 product.

Products include Glpi-Project Glpi.

How do I fix CVE-2022-31056?

No fix has been published for CVE-2022-31056 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2022-31056 being exploited?

There is no known exploitation of CVE-2022-31056 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in Glpi-Project Glpi

• CVE-2022-35914 Teclib GLPI Remote Code Execution Exploited Critical 9.8
• CVE-2023-42802 GLPI vulnerable to unallowed PHP script execution Critical 10.0
• CVE-2023-28849 GLPI vulnerable to SQL injection and Stored XSS via inventory agent request Critical 10.0
• CVE-2022-35947 SQL injection in GLPI Critical 10.0
• CVE-2022-31061 SQL injection on login page in GLPI Critical 9.8

All Glpi-Project Glpi vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9q9x-7xxh-w4cg, UBUNTU-CVE-2022-31056.