CVE-2022-31061

CRITICAL

GLPI - SQL Injection

Title source: llm

Description

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions there is a SQL injection vulnerability which is possible on login page. No user credentials are required to exploit this vulnerability. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.

Exploits (2)

nomisec WORKING POC 4 stars
by Wangyanan131 · poc
https://github.com/Wangyanan131/CVE-2022-31061

References (2)

Scores

CVSS v3 9.8
EPSS 0.5177
EPSS Percentile 97.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
glpi-project/glpi 9.3.0 - 9.5.8
Published Jun 28, 2022
Tracked Since Feb 18, 2026