CVE-2018-13049 in GLPI
Summary
by MITRE
The constructSQL function in inc/search.class.php in GLPI 9.2.x through 9.3.0 allows SQL Injection, as demonstrated by triggering a crafted LIMIT clause to front/computer.php.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 03/29/2023
The vulnerability identified as CVE-2018-13049 represents a critical SQL injection flaw within the GLPI (Gestionnaire Libre de Parc Informatique) IT asset management system. This vulnerability exists in the constructSQL function located within the inc/search.class.php file, affecting versions 9.2.x through 9.3.0 of the software. The flaw enables malicious actors to inject arbitrary SQL commands into database queries, potentially compromising the entire system's data integrity and confidentiality. The vulnerability is particularly concerning because it can be exploited through a crafted LIMIT clause that is processed by the front/computer.php endpoint, which serves as a primary interface for computer inventory management within the GLPI platform.
The technical implementation of this vulnerability stems from inadequate input validation and sanitization within the search functionality of GLPI. When users perform searches or filter computer inventory data through the web interface, the system constructs SQL queries dynamically based on user-supplied parameters. The constructSQL function fails to properly escape or validate the LIMIT clause parameters, allowing attackers to inject malicious SQL syntax that gets executed against the underlying database. This type of vulnerability falls under CWE-89, which specifically addresses SQL injection weaknesses in software applications. The flaw demonstrates poor input handling practices where user-controllable data directly influences database query construction without proper sanitization mechanisms.
The operational impact of this vulnerability extends beyond simple data theft, as it can enable complete database compromise and potential system takeover. An attacker exploiting this vulnerability could extract sensitive information including user credentials, system configurations, and inventory data that may contain confidential business information. The vulnerability is particularly dangerous in enterprise environments where GLPI is used for managing critical IT infrastructure, as it could provide unauthorized access to the entire computer inventory database. This represents a significant risk under the ATT&CK framework's T1071.004 technique for application layer protocol manipulation, where attackers leverage web application vulnerabilities to gain deeper system access.
Mitigation strategies for CVE-2018-13049 should prioritize immediate patching of affected GLPI versions to the latest stable releases that contain proper input validation fixes. Organizations should implement network segmentation and access controls to limit exposure of the GLPI web interface to untrusted networks. Database-level protections including query parameterization, input validation, and privilege restriction should be enforced to minimize potential damage from successful exploitation attempts. Security monitoring should be enhanced to detect unusual database query patterns that might indicate SQL injection attempts. The vulnerability highlights the importance of proper input validation and the principle of least privilege in database access, which aligns with security best practices outlined in the OWASP Top Ten and NIST cybersecurity frameworks. Additionally, regular security audits of web applications should be conducted to identify similar input validation weaknesses that could lead to similar exploitation vectors.