A vulnerable version of GLPI allows an authenticated user to inject arbitrary SQL statements through the logs export interface. The flaw is a classic injection point (CWE-89), which could enable the modification or extraction of database contents and potentially disrupt the integrity of asset data. The vulnerability can be triggered by any user who has legitimate login credentials and access to the logs export feature.

GLPI versions 10.0.0 up to but not including 10.0.24, and 11.0.0 up to but not including 11.0.6 are susceptible. Upgrading to 10.0.24 or 11.0.6 mitigates the issue.

With a CVSS score of 7.2, this flaw is considered high severity. Exploitation requires an authenticated session, so an attacker must first compromise an account or gain legitimate access. The public exploit probability (EPSS) is currently not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Nonetheless, the possibility of database compromise warrants swift attention.