Description
GLPI是一款开源的IT资产管理软件，其部分版本中存在SQL注入漏洞（CVE-2025-24799）。攻击者可通过构造恶意XML请求，在deviceid参数中注入SQL语句，利用时间盲注的方式获取数据库敏感信息。
GLPI /index.php/ajax/ SQL 注入漏洞（CVE-2025-24799）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-24799
https://github.com/glpi-project/glpi/security/advisories/GHSA-jv89-g7f7-jwfg
https://blog.lexfo.fr/glpi-sql-to-rce.html
https://lmboke.com/archives/glpi-zhong-de-yu-shen-fen-yan-zheng-sql-zhu-ru-dao-rce-cve-2025-24799-cve-2025-24801
https://cve.imfht.com/poc_detail/dfc3a11d88209edc2b59085a01f2baafa18887a0
https://cn-sec.com/archives/3870499.html
https://blog.onyphe.io/en/new-critical-vulnerabilities-in-glpi-cve-2025-24799-and-cve-2025-24801/
https://kudelskisecurity.com/research/pre-authentication-sql-injection-to-rce-in-glpi
https://avd.aliyun.com/product?prod=glpi