GLPI Unauthenticated Time-Based Blind SQL Injection Vulnerability in Search Engine

A time-based blind SQL injection vulnerability, allowing unauthenticated exploitation, has been identified in the search engine of GLPI (versions 11.0.0 prior to 11.0.6). This vulnerability arises from improper handling of search queries, which can be manipulated to execute arbitrary SQL commands. The issue is particularly concerning as it can be exploited without authentication, potentially leading to unauthorized data access or manipulation.

Impact

Exploitation of this vulnerability allows for time-based blind SQL injection, where an attacker can execute SQL queries that the application processes, potentially leading to unauthorized data access or modification.

Remediation

Users are advised to upgrade to GLPI version 11.0.6. Alternatively, anonymous access to the FAQ can be disabled to prevent exploitation of this vulnerability by unauthenticated users.