Datainjection
Approved changes feed: RSS · Atom
cpe:2.3:a:pluginsglpi:datainjection:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Pluginsglpi (06299ce7-7c01-5e27-80d2-610e38d2f6b3) |
|---|---|
| Product | Datainjection (b9b789d1-bcbc-54cf-a725-513dfa960934) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-11321 |
vulnerable | 2026-07-29 00:23:30.910058 |
GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import
MEDIUM (6.4)
The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly into SQL queries during CSV import, without parameterization or escaping, resulting in authenticated SQL injection. An authenticated user with access to the Data injection feature can embed SQL expressions such as SLEEP() in a mapped field (for example Serial Number) to manipulate the generated query and extract database information via time-based blind injection.
Published: 2026-07-10T18:53:56.004Z
Updated: 2026-07-30T14:39:12.341Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.