CVE-2024-31456: GLPI map search SQL injection allows authenticated data theft

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe flaw is remotely reachable by any authenticated user with high confidentiality impact, and EPSS is very high at the 99th percentile even though it is not in KEV.

What it is

GLPI before 10.0.15 contains a SQL injection flaw reachable from the map search feature. An authenticated user can inject SQL through that search path, and the vendor has fixed it in 10.0.15. Because GLPI stores asset and IT management data, a successful injection can expose sensitive records.

Impact

An attacker with a valid account gains read access to data behind the vulnerable query, with high confidentiality impact. Integrity and availability are not affected per the CVSS vector.

Attack surface

The flaw is network-reachable via the map search functionality and requires a low-privileged authenticated account; no user interaction is needed per the CVSS vector.

Exploitation

No public exploitation is confirmed in the record: CISA KEV does not list it, and references are limited to the patch and vendor advisory. EPSS is high at 0.59136 (99th percentile), indicating elevated predicted exploitation likelihood.

What to do

• Upgrade GLPI to 10.0.15 or later, applying the vendor patch commit.
• If immediate upgrade is not possible, restrict access to the map search feature and limit accounts to only the privileges they require.
• Review GLPI accounts for unnecessary or stale users and remove them to reduce the authenticated attack surface.
• Monitor the vendor advisory GHSA-gcj4-2cp3-6h5j for any updated guidance.

Detection

• Inspect web and application logs for SQL metacharacters or unusual query patterns in requests to map search endpoints.
• Alert on anomalous database query volume or errors originating from GLPI application accounts.
• Baseline normal map search usage and flag deviations from authenticated accounts, especially low-privilege ones.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.