CVE-2023-35924: GLPI inventory endpoint SQL injection, unauthenticated

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable SQL injection with a 9.8 CVSS score and high EPSS probability, patched in 10.0.8.

What it is

GLPI versions 10.0.0 through 10.0.7 expose an inventory endpoint that is vulnerable to SQL injection and requires no authentication by default. An unauthenticated attacker can reach the endpoint over the network and inject SQL, which matters because the endpoint is part of normal inventory handling and is enabled by default. Version 10.0.8 contains the fix.

Impact

Successful exploitation gives the attacker full read and write access to the underlying database, with high confidentiality, integrity and availability impact per the CVSS vector. That can mean disclosure of all stored asset and IT management data plus the ability to alter or destroy it.

Attack surface

The flaw is reached over the network through the GLPI inventory endpoint, with no authentication and no user interaction required (CVSS AV:N/PR:N/UI:N). Any host that can reach the GLPI web service can attempt it.

Exploitation

CISA KEV does not list this CVE, but EPSS is high at roughly 0.51 probability over 30 days (98.9th percentile), indicating elevated likelihood of exploitation activity. The references are only vendor advisory and release notes, so no public exploit code is confirmed by the record.

What to do

• Upgrade GLPI to version 10.0.8 or later, which patches the issue.
• If immediate upgrade is not possible, disable native inventory as the vendor-documented workaround.
• Restrict network access to the GLPI inventory endpoint to trusted inventory sources only.
• Review database accounts used by GLPI for least privilege to limit injection impact.
• Monitor for and investigate unexpected SQL errors or anomalous requests to the inventory endpoint.

Detection

• Inspect web server and GLPI logs for SQL error messages or malformed requests to the inventory endpoint.
• Alert on inventory endpoint requests from unexpected source IPs or with unusual query parameters.
• Baseline normal inventory traffic volume and flag deviations that suggest automated injection attempts.
• Review database query logs for injected statements or unexpected schema access originating from the GLPI application.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.