CVE-2023-36808: GLPI SQL injection in Computer Virtual Machine form and inventory request

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, and no user interaction, plus a very high EPSS percentile, makes this a top remediation priority despite no KEV listing.

What it is

GLPI versions from 0.80 up to but not including 10.0.8 contain a SQL injection flaw reachable through the Computer Virtual Machine form and the GLPI inventory request. The vendor advisory and release notes confirm version 10.0.8 patches the issue. Because the injection point is network-reachable and requires no authentication or user interaction, it is a serious pre-auth database compromise risk.

Impact

An unauthenticated attacker can inject arbitrary SQL, potentially reading, modifying, or deleting data in the GLPI database and, depending on database privileges, executing database-level functions. This can expose asset, inventory, and user data managed by GLPI.

Attack surface

Reached over the network via the Computer Virtual Machine form and the GLPI inventory request endpoint. The CVSS vector shows no privileges required and no user interaction, so the injection is exploitable pre-authentication.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is 0.478 (98.8th percentile), indicating a high modeled likelihood of exploitation activity.

What to do

• Upgrade GLPI to version 10.0.8 or later, which contains the vendor patch.
• If immediate upgrade is not possible, disable native inventory as the vendor workaround states.
• Restrict network access to the GLPI inventory and Computer Virtual Machine endpoints to trusted management networks.
• Review database account privileges used by GLPI and remove unnecessary DDL or file-level permissions.
• Monitor vendor advisory GHSA-vf5h-jh9q-2gjm for any updated guidance.

Detection

• Inspect web and application logs for SQL metacharacters or unusual payloads in requests to the Computer Virtual Machine form and inventory endpoints.
• Enable and review database query logging for anomalous SQL originating from the GLPI application account.
• Alert on unexpected changes to GLPI database contents or schema that do not correlate with normal administrative activity.
• Correlate inventory endpoint access from untrusted source IPs with subsequent database errors or unusual query patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.