CVE-2026-22821
SQL Injection in mreporting GLPI Plugin Before
Publication date: 2026-02-12
Last updated on: 2026-02-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| glpi-project | more_reporting | to 1.9.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-22821 is a SQL injection vulnerability in the mreporting plugin for GLPI, affecting versions up to 1.9.3. The issue occurs because user input related to date changes is directly embedded into SQL queries without proper sanitization or escaping. Specifically, the plugin used to construct SQL queries by concatenating the user's locale string directly into the query, which allowed attackers to inject malicious SQL commands. This vulnerability was fixed in version 1.9.4 by replacing the vulnerable code with parameterized queries using prepared statements, which safely handle user input and prevent SQL injection."}] [1, 2]
How can this vulnerability impact me? :
This vulnerability allows an attacker with high privileges to remotely execute malicious SQL commands on the affected system without requiring user interaction. The primary impact is on confidentiality, as the attacker could potentially access sensitive data stored in the database. However, it does not affect data integrity or availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability is a SQL injection in the mreporting plugin for GLPI versions up to 1.9.3, specifically related to the handling of date changes. Detection involves identifying if the vulnerable plugin version is in use and monitoring for suspicious SQL queries or unusual database activity related to the locale setting or date parameters.'}, {'type': 'paragraph', 'content': 'Since the vulnerability involves SQL injection via the locale setting in the session variable, you can check the version of the mreporting plugin installed on your system. If it is version 1.9.3 or earlier, it is vulnerable.'}, {'type': 'paragraph', 'content': 'To detect exploitation attempts or suspicious activity, you can monitor database logs for unusual queries that attempt to inject SQL commands through the locale or date parameters.'}, {'type': 'paragraph', 'content': 'Example commands to check the installed plugin version or search logs might include:'}, {'type': 'list_item', 'content': 'Check the plugin version in GLPI: Navigate to the plugin management section in the GLPI web interface or check the plugin directory for version files.'}, {'type': 'list_item', 'content': "Search database logs for suspicious queries containing unexpected SQL syntax or injection patterns related to 'lc_time_names' or date parameters."}, {'type': 'list_item', 'content': 'Use network monitoring tools to detect unusual SQL traffic originating from the GLPI server.'}] [1, 2]
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade the mreporting plugin to version 1.9.4 or later, where the vulnerability has been fixed by using parameterized queries to prevent SQL injection.
If immediate upgrade is not possible, restrict access to the GLPI system to trusted users only, especially since the vulnerability requires high privileges to exploit.
Monitor and audit database and application logs for suspicious activity related to SQL injection attempts.
Consider applying web application firewall (WAF) rules to detect and block SQL injection patterns targeting the vulnerable parameters.