GLPI, an IT asset management software, suffers from an SQL injection vulnerability (CWE-89) in its history tab endpoint. Specifically, from version 9.4.0 through versions prior to 10.0.26, and from 11.0.0 through versions prior to 11.0.8, an attacker with read access to logs can inject attacker-controlled values into a database query via a crafted URL. This improper neutralization of special elements in SQL commands allows for potential injection attacks. The issue is resolved in versions 10.0.26 and 11.0.8.

An attacker with read permissions on logs can exploit this vulnerability to perform SQL injection via the history tab endpoint. This could lead to unauthorized database queries or data exposure depending on the database and application context. The CVSS 4.0 score is 7.1 (high severity), indicating a significant risk if exploited. There are no known exploits in the wild at this time.

Upgrade GLPI to version 10.0.26 or later, or 11.0.8 or later, where this SQL injection vulnerability has been fixed. No other mitigation steps are indicated by the vendor advisory.