CVE-2023-28849 GLPI vulnerable to SQL injection and Stored XSS via inventory agent request
Unauthenticated attackers can exploit the inventory endpoint to perform SQL injection and stored XSS, potentially leading to data theft or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-28849?
CVE-2023-28849 is a critical SQL injection vulnerability in Glpi-Project Glpi, published on 5 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.7, GLPI inventory endpoint can be used to drive a SQL injection attack. It can also be used to store malicious code that could be used to perform XSS attack. By default, GLPI inventory endpoint requires no authentication. Version 10.0.7 contains a patch for this issue. As a workaround, disable native inventory.
Which versions are affected by CVE-2023-28849?
It affects 1 product.
Products include Glpi-Project Glpi.
How do I fix CVE-2023-28849?
No fix has been published for CVE-2023-28849 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2023-28849 being exploited?
There is no known exploitation of CVE-2023-28849 in the wild and no public exploit code.
Other vulnerabilities in Glpi-Project Glpi
Sources
Also known as GHSA-9r84-jpg3-h4m6, UBUNTU-CVE-2023-28849.