CVE-2022-29250

HIGH

GLPI < 10.0.1 - Authenticated SQL Injection on Search Pages

Title source: llm
STIX 2.1

Description

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to version 10.0.1 it is possible to add extra information by SQL injection on search pages. In order to exploit this vulnerability a user must be logged in.

References (1)

Core 1
Core References

Scores

CVSS v3 8.1
EPSS 0.0025
EPSS Percentile 48.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-89
Status published
Products (1)
glpi-project/glpi 10.0.0 (5 CPE variants)
Published Jun 09, 2022
Tracked Since Feb 18, 2026