CVE-2025-24799 - GLPI SQL Injection Exploit

Exploit for unauthenticated SQL injection vulnerability in GLPI.

Vulnerability Information

Field	Value
CVE	CVE-2025-24799, CVE-2025-24801
Product	GLPI (Asset Management Software)
Type	Unauthenticated SQL Injection
Vulnerable Point	/index.php/ajax/ endpoint
Affected Function	handleAgent with deviceid parameter
Vulnerable Version	< 10.0.18
Fixed in	GLPI 10.0.18

Technical Explanation

The exploit leverages the lack of proper sanitization of the deviceid parameter in GLPI's agent inventory endpoint. The handleAgent function accepts this parameter without proper escaping, allowing SQL injection through the dbEscapeRecursive function.

Attack Mechanism

1. The exploit sends malformed XML payloads to the /index.php/ajax/ endpoint
2. Uses SQL injection techniques: time-based, union-based, and error-based
3. Can extract credentials, API tokens for RCE (CVE-2025-24801), and database data

Exploit Parameters

Argument	Type	Required	Description	Default
-u, --url	string	Yes	URL of the target GLPI instance (includes http/https)	Required
--check	flag	No	Only verify vulnerability without actively exploiting	false
--exploit	flag	No	Perform active exploitation and extract data	false
-t, --timeout	integer	No	Request timeout in seconds	10

Usage Examples

Verify if the vulnerability exists (modal, non-intrusive)

python3 exploit_cve_2025_24799.py -u https://HOST.com --check

Only verify endpoint version

python3 exploit_cve_2025_24799.py -u https://HOST.com

Active exploitation mode (with custom timeout)

python3 exploit_cve_2025_24799.py -u https://HOST.com --exploit --timeout 15

Full usage with all parameters

python3 exploit_cve_2025_24799.py -u https://HOST.com--check --timeout 20

Show full help

python3 exploit_cve_2025_24799.py --help

System Requirements

python3 >= 3.6
requests == 2.31.0

Installing dependencies

pip install -r requirements.txt

Available Attacks (via SQL Injection methods)

1. Database Enumeration - Extract credentials from the glpi_users table
2. API Token Exfiltration - Retrieve plaintext tokens for RCE
3. Time-based Blind SQLi - Time-based attacks when WAF blocks UNION errors
4. Error-based SQLi - Trigger database errors to extract data column by column

Legal Disclaimer

IMPORTANT LEGAL WARNING

This exploitation code is provided solely for ethical security testing purposes and with proper authorization.

• Use this exploit ONLY on systems where you have explicit written permission
• Misuse may result in legal action (Computer Fraud and Abuse Act, DMCA, etc.)
• Do not use this tool against third-party infrastructures without prior authorization
• Ensure you have valid authorization before using this exploit against any target

REQUIRED AUTHORIZATION:

• Audit documentation with defined scope
• Permission letters from the system owner
• Signed rules of engagement

Responsible Use

This exploit is intended for:

• ✅ Authorized pentesting (with contract)
• ✅ Auditing your own security (your own systems)
• ✅ Academic/educational research
• ✅ Incident response (with legal authorization)

Not permitted for:

• ❌ Malicious attacks against third parties
• ❌ Data or credential theft
• ❌ Unauthorized use for RCE
• ❌ Distribution without permission from the original author

References

Source	Description
CVE Database	CVE-2025-24799, CVE-2025-24801
Vendor Advisory	GLPI Security Bulletin
NVD	NVD CVE entry and CVSS score

Author

G4l1l30 - Security research purpose

---

This exploit is intended for ethical security researchers and professionals. Misuse is the responsibility of the user.