Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2024-29889 — SQL Injection in Glpi

CWE-89 — SQL Injection5 documents4 sources
Severity
8.1HIGHNVD
EPSS
72.3%
top 1.24%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Glpi-project Glpi
Timeline
PublishedMay 7
Latest updateJan 28

Description

GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searches feature to alter another user account data take control of it. This vulnerability is fixed in 10.0.15.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NExploitability: 2.8 | Impact: 5.2

Affected Packages2 packages

▶CVEListV5glpi-project/glpi< 10.0.15
▶NVDglpi-project/glpi10.0.10 — 10.0.15

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

1
OSV
CVE-2024-29889: GLPI is a Free Asset and IT Management Software package↗2024-05-07
▶

💥Exploits & PoCs

1
Nuclei
GLPI 10.0.10-10.0.14 - SQL Injection
▶

🔍Detection Rules

2
Suricata
ET WEB_SPECIFIC_APPS GLPI Authenticated SQL Injection in Saved Searches (CVE-2024-29889)↗2026-01-28
▶
Suricata
ET WEB_SPECIFIC_APPS GLPI Authenticated SQL Injection in Map Search (CVE-2024-31456)↗2026-01-28
▶