The vulnerability originates in the mreporting GLPI plugin, where a flaw in the handling of date changes can allow a malicious user to inject arbitrary SQL commands into the backend database. This SQL injection can potentially lead to unauthorized data exfiltration or modification, compromising the confidentiality and integrity of the GLPI instance.

Vendors: GLPI. Product: mreporting plugin for the GLPI project. Versions prior to 1.9.4 are vulnerable; the issue is resolved in release 1.9.4 and later.

The CVSS score of 4.9 indicates medium severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and it appears to be exploitable only through the web interface when users modify date fields. Existing authentication and authorization controls may limit the reach of the injected payload, but the risk remains significant enough to warrant patching.