PT-2026-57275 · Glpi · Datainjection

Ryukk33 · Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-11321

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DataInjection plugin for GLPI version 2.15.6

Description An authenticated user with access to the data injection feature can perform a time-based blind SQL injection. This occurs because the plugin concatenates user-supplied CSV field values directly into SQL queries during the CSV import process without using parameterization or escaping. An attacker can embed SQL expressions, such as SLEEP(), within a mapped field like Serial Number to manipulate the query and extract sensitive database information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-11321

Affected Products

Datainjection

References · 7

• https://github.com/pluginsGLPI/datainjection/security/advisories/GHSA-57qv-j6r6-pcc4 · Vendor Advisory
• https://github.com/pluginsGLPI/datainjection/releases/tag/2.15.7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-11321 · Security Note
• https://github.com/pluginsGLPI/datainjection · Note
• https://vulncheck.com/advisories/glpi-datainjection-plugin-authenticated-sql-injection-via-csv-import · Note
• https://twitter.com/CVEnew/status/2075666959278936093 · Twitter Post
• https://twitter.com/infoflowcloud/status/2075667784973832591 · Twitter Post