GLPI · Public exploit code

GLPI: unauthenticated SQL injection and impersonation RCE disclosed

Oct 30, 2026 · 1 min read

Two independent studies report flaws in GLPI, an IT asset management and service desk platform. Mobeta confirmed, with a PoC on a clean GLPI 11.0.8 install, an unauthenticated SQL injection exposing password hashes and other database data; Fenrisk demonstrated server impersonation via AD CS ESC17, with command execution on managed hosts as SYSTEM/root. The sources cite no fix; administrators should follow the project's advisories.

By HIFY Radar newsroom Updated 10/30/2026 06:12 AM Get this every day →← Back to the feed 1 source

HighVulnerabilityPublic exploit codeFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Researchers from Mobeta and Fenrisk disclosed flaws in GLPI, an IT asset management and service desk system. An unauthenticated SQL injection allows reading database data, including password hashes. A second study shows how to impersonate the GLPI server and run commands on the machines it manages.

Why it matters

Anyone who can reach a GLPI 11 server, without logging in, can extract password hashes, configuration, inventory, and tickets. With server impersonation via Active Directory certificates, an attacker runs commands with maximum privileges on managed hosts, potentially halting operations and compromising the network.

What to do

Restrict access to GLPI, especially the /front/planning.php page, and review logs for anomalous queries. Follow GLPI project advisories and apply the fix once released; consider changing administrative passwords.

For the technical team

Affected: GLPI (plataforma de gestão de ativos de TI e service desk) · GLPI 11 (confirmed on a clean 11.0.8 install); experimental 12-dev branch also cited. The RCE path abuses Active Directory Certificate Services certificates (ESC17).
Exploitation: No real-world exploitation reported in the sources. A Mobeta researcher confirmed the injection with a PoC on GLPI 11.0.8: SLEEP via an uncorrelated subquery against the glpi_configs table, since planning tables may be empty. Fenrisk demonstrated server impersonation via ESC17.
Fix: The sources cite no fixed version, patch, or mitigation.
Vector: Component: GLPI 11, page /front/planning.php. Flaw: unauthenticated, time-based blind SQL injection requiring no login. The genical parameter makes the application skip Session::checkRight("planning", READ) and checkavailability invokes Planning::checkAvailability before the iCalendar token validation branch; the request must reference an existing record via itemtype and users_id; begin and end reach CommonITILTask::genericPopulatePlanning and ProjectTask::populatePlanning, where the not_planned branch concatenates them into SQL via new QueryExpression(...), bypassing the query builder's escaping.
More details: The SQLi provides read access: password hashes, configuration, inventory records, and tickets; direct RCE was not demonstrated, and taking over an administrator account on 11.0.8 may require cracking an extracted hash. On 12-dev, the researcher also found that SessionTracker stores PHP session identifiers (source text truncated). Discovered by: Mobeta (SQLi) and Fenrisk (ESC17); the ESC17 path runs commands on managed hosts with SYSTEM/root privileges.