Loading vulnerability…
CVE-2025-24799 is an unauthenticated SQL injection vulnerability in GLPI, a free asset and IT management software package. According to the provided content, an attacker can perform SQL injection through the inventory endpoint without authentication. The issue affects vulnerable GLPI deployments prior to the fix released in version 10.0.18. No additional vulnerable function or parameter details are provided in the supplied material.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
This repository is a proof-of-concept (PoC) exploit for CVE-2025-24799, targeting the GLPI IT asset management software. The exploit demonstrates an unauthenticated time-based blind SQL injection vulnerability, allowing an attacker to extract usernames and password hashes from the 'glpi_users' table. The main exploit logic is stored in an encrypted binary file ('main.bin'), which is decrypted at runtime by 'main.py' using a key from the '.key' file. The Python script requires the user to specify a target URL (e.g., http://target.com/index.php/ajax), which is likely the vulnerable endpoint. The repository includes a README with detailed usage instructions, requirements (requests, colorama, beautifulsoup4), and example output. The attack vector is network-based, exploiting a web endpoint without authentication. No hardcoded IPs or domains are present, but the exploit is fingerprintable by its use of the '/index.php/ajax' endpoint and its focus on the 'glpi_users' table. The code is operational as a PoC, with the actual exploit logic obfuscated in the encrypted payload.
This repository contains a Python exploit script (exploit.py) targeting CVE-2025-24799, an unauthenticated time-based blind SQL injection vulnerability in GLPI. The exploit works by sending specially crafted XML payloads via HTTP POST requests to a GLPI endpoint (e.g., /index.php/ajax). It leverages time delays (SLEEP) to infer database content, specifically extracting usernames and password hashes from the glpi_users table. The script is operational, automating the extraction process and providing clear output for each credential found. The repository includes a README with usage instructions, a requirements.txt for dependencies (requests, colorama), and a standard MIT license. No hardcoded endpoints are present; the user must supply the target URL. The exploit does not require authentication and is designed for remote, unauthenticated attacks against vulnerable GLPI instances.
This repository contains a single Metasploit auxiliary module targeting an unauthenticated blind boolean SQL injection vulnerability (CVE-2025-24799) in the GLPI Inventory plugin (<= 1.0.18). The exploit works by sending crafted XML payloads via HTTP POST requests to the '/glpi/index.php/ajax/' endpoint, exploiting improper sanitization of user input in the 'deviceid' field. The module is capable of extracting sensitive information such as usernames, password hashes, and API tokens from the 'glpi_users' database table, even without authentication. The exploit requires the GLPI Inventory plugin to be installed, enabled, and properly configured. The code is written in Ruby and is structured as a standard Metasploit module, making use of Metasploit's SQLi and HTTP client libraries. The repository is operational and provides a working exploit for credential extraction from vulnerable GLPI installations.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability in GLPI that is being actively exploited (alongside other CVEs) by the same dominant exploitation source IP; the specific technical impact is not described in the content.
A vulnerability in GLPI that was exploited by the same automated activity during the referenced time period.
A specific vulnerability affecting GLPI IT Asset Management that the same infrastructure was observed exploiting concurrently with the Ivanti campaign.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.