CVE-2024-29889

HIGH NUCLEI

GLPI 10.0.10-10.0.14 - Authenticated SQL Injection via Saved Searches Feature

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2024-29889 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searches feature to alter another user account data take control of it. This vulnerability is fixed in 10.0.15.

Nuclei Templates (1)

GLPI 10.0.10-10.0.14 - SQL Injection
HIGHVERIFIEDby iamnoooob,rootxharsh,pdresearch
Shodan: http.title:"glpi"

References (2)

Core 2

Scores

CVSS v3 7.1
EPSS 0.6493
EPSS Percentile 99.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (1)
glpi-project/glpi 10.0.10 - 10.0.15
Published May 07, 2024
Tracked Since Feb 18, 2026