CVE-2023-43813 — SQL Injection in Glpi

CWE-89 — SQL InjectionCWE-22 — Path Traversal4 documents4 sources
Severity
8.8HIGHNVD
EPSS
11.5%
top 6.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Glpi-project Glpi
Timeline
PublishedDec 13
Latest updateJan 28

Description

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, the saved search feature can be used to perform a SQL injection. Version 10.0.11 contains a patch for the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDglpi-project/glpi10.0.0 — 10.0.11
▶CVEListV5glpi-project/glpi>= 10.0.0, < 10.0.11

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet↗2025-09-30
▶
OSV
CVE-2023-43813: GLPI is a free asset and IT management software package↗2023-12-13
▶

🔍Detection Rules

1
Suricata
ET WEB_SPECIFIC_APPS GLPI Authenticated SQL Injection in Saved Searches (CVE-2023-43813)↗2026-01-28
▶