An SQL injection flaw exists in the logs export function of GLPI. An authenticated user can supply crafted input that is incorporated into an SQL statement, allowing arbitrary queries or modifications against the database. This can lead to disclosure of sensitive data, alteration of records, or deletion of entries, compromising confidentiality, integrity, and potentially availability of the system.

GLPI versions 10.0.0 through 10.0.23 and all 11.x releases prior to 11.0.6 are affected. The vulnerability was fixed in 10.0.24 and 11.0.6 and later versions of GLPI.

The CVSS v3.1 score is 7.2, indicating high severity. The EPSS score is below 1%, implying a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated web session and use of the logs export operation, after which an attacker can inject malicious SQL statements.