UpHeron
All vulnerabilities

Servers and applications

CVE-2024-40638

Account takeover through SQL injection

Severity
High 8.8
Published
15 Nov 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
10.0.17
Also known as
GHSA-8843-r3m7-gfqx
Sources
NVD, Project advisories (GitHub)

Description

GLPI is a free asset and IT management software package. An authenticated user can exploit multiple SQL injection vulnerabilities. One of them can be used to alter another user account data and take control of it. Upgrade to 10.0.17.

Affected software

SoftwareAffected versions
GLPIServers and applications · cpe:a:glpi-project:glpi
  • From 0.85 before 10.0.17
GLPIServers and applications · github:glpi-project/glpi
  • From 0.85 before 10.0.17

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-40638
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-40638
  • GitHub Advisory Database https://github.com/advisories/GHSA-8843-r3m7-gfqx
  • github.com https://github.com/glpi-project/glpi/security/advisories/GHSA-8843-r3m7-gfqx