Medium severity · published Oct 7, 2020
CVE-2020-15226
In GLPI before version 9.5.2, there is a SQL Injection in the API's search function
4.3
CVSS
1%
EPSS
No
On KEV
Description
In GLPI before version 9.5.2, there is a SQL Injection in the API's search function. Not only is it possible to break the SQL syntax, but it is also possible to utilise a UNION SELECT query to reflect sensitive information such as the current database version, or database user. The most likely scenario for this vulnerability is with someone who has an API account to the system. The issue is patched in version 9.5.2. A proof-of-concept with technical details is available in the linked advisory.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GL
Glpi · Glpi-project
before 9.5.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-15226
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-15226
Patch
https://github.com/glpi-project/glpi/commit/3dc4475c56b241ad659cc5c7cb5fb65727409cf0
Exploit
https://github.com/glpi-project/glpi/security/advisories/GHSA-jwpv-7m4h-5gvc
More from Glpi
9.8
CVE-2022-35914
Teclib GLPI Remote Code Execution Vulnerability
9.8
CVE-2026-26263
GLPI has an Unauthenticated SQL Injection via Search engine
9.8
CVE-2025-66417
GLPI has an unauthenticated SQL injection through the inventory endpoint
9.8
CVE-2025-24799
GLPI is a free asset and IT management software package
9.8
CVE-2025-21619
GLPI is a free asset and IT management software package