SQL Injection in GLPI DataInjection Plugin

Executive Summary

The DataInjection plugin for GLPI version 2.15.6 and earlier is vulnerable to an authenticated SQL injection attack. This happens because the plugin directly concatenates user-supplied CSV field values into SQL queries during CSV import without proper parameterization or escaping.

An authenticated user with access to the DataInjection feature can embed malicious SQL expressions, such as the SLEEP() function, into a mapped CSV field (for example, the Serial Number field). This allows them to manipulate the generated SQL query and potentially extract sensitive database information using time-based blind SQL injection techniques.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an authenticated attacker with access to the DataInjection feature to execute arbitrary SQL commands on the database.

Such exploitation can lead to unauthorized extraction of sensitive data from the database, potentially compromising confidentiality and integrity of the stored information.

Because the attack uses time-based blind SQL injection, it may be used to infer data even if direct error messages or outputs are not available.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusual SQL query behavior during CSV imports in the DataInjection plugin of GLPI versions 2.15.6 and below. Specifically, look for SQL queries that include unexpected SQL expressions such as SLEEP() embedded in CSV field values.

Since the vulnerability involves time-based blind SQL injection, one detection method is to test the CSV import feature with specially crafted CSV files containing SQL expressions like SLEEP(5) in fields such as Serial Number and observe if the import process delays accordingly, indicating the injection is successful.

Commands or steps to detect the vulnerability might include:

• Prepare a CSV file with a field containing a payload like: 12345'), SLEEP(5), ('67890
• Import the CSV file using the DataInjection plugin in GLPI.
• Observe if the import process takes significantly longer than usual, indicating the SLEEP() function was executed.
• Check application logs or database logs for suspicious SQL queries containing injected SQL expressions.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the DataInjection plugin for GLPI to version 2.15.7 or later, where this SQL injection vulnerability has been patched.

Until the upgrade can be applied, restrict access to the DataInjection feature to only trusted and necessary authenticated users to reduce the risk of exploitation.

Additionally, monitor and audit CSV imports for suspicious activity and consider disabling CSV import functionality if it is not required.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated user to perform SQL injection attacks that can extract sensitive data from the database.

Such unauthorized data extraction could lead to exposure of personal or protected health information, potentially violating data protection regulations like GDPR and HIPAA.

Therefore, this vulnerability poses a risk to compliance with common standards and regulations that require safeguarding sensitive data against unauthorized access.

Useful 0 Not Useful 0