Executive brief
The DataInjection plugin for GLPI, an asset management software, contains a security flaw in its CSV import feature. An authorized user could upload a specially crafted file to run unauthorized database commands. This could allow an attacker to steal sensitive information or disrupt the organization's asset tracking operations.
Technical details
An authenticated SQL injection vulnerability exists in the DataInjection plugin for GLPI version 2.15.6. The root cause is the direct concatenation of user-supplied CSV field values into SQL queries during the import process without proper parameterization or escaping. An attacker with high privileges and access to the Data Injection feature can embed malicious SQL expressions, such as SLEEP(), into mapped fields like 'Serial Number'. This allows for time-based blind SQL injection to extract sensitive information from the database. The issue is addressed in version 2.15.7.
Affected products
- pluginsGLPI DataInjection 2.15.6 (GLPI 11 builds)
Timeline
- 2026-05-29: patched: Version 2.15.7 released
- 2026-07-10: disclosed: CVE-2026-11321 published