The DataInjection plugin for GLPI concatenates user‑supplied CSV field values directly into SQL queries during import without parameterization or escaping. This flaw, classified as CWE‑89, enables an authenticated attacker with access to the CSV import feature to inject SQL expressions such as SLEEP(), allowing time‑based blind extraction of database data. The impact is loss of confidentiality.

The vulnerability exists in the DataInjection plugin version 2.15.6 for GLPI 11 builds. Users with Import permission in GLPI who can access the DataInjection plugin are affected. No other product versions are currently listed.

The CVSS score is 7.1, indicating moderate to high severity. The EPSS score is <1%, indicating a very low probability of exploitation, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is through an authenticated CSV import; only users with sufficient privileges can trigger the injection. The lack of public exploitation data suggests the risk is currently theoretical but could be realized by insiders or compromised accounts.