GLPI Unauthenticated SQL Injection. Upgrade. Restrict. Hunt.
An unauthenticated SQL injection in GLPI lets an attacker read the whole database, take over admin accounts and possibly run code. Clear steps for businesses, internal IT teams and MSPs running GLPI for helpdesk and asset management.
At a Glance
Facts from GLPI's 11.0.9 release notes and the security researchers' write-up. There is no CVE yet and the GitHub advisory page for GHSA-753w-2942-4pxm is not yet published. Not reported exploited and not on the CISA KEV catalog as of 22 October 2026, 20:17 BST. Last updated 22 October 2026, 20:45 BST.
Fixed in 11.0.9
GLPI 11.0.9 and later fix the flaw. Every version up to and including 11.0.8 is affected.
Unauthenticated SQLi
No login needed. Sending the genical and checkavailability parameters together to front/planning.php skips rights and CSRF token checks.
Database to admin
An attacker can read the whole database, which can lead to admin account takeover and possible remote code execution.
Not reported exploited
Not reported exploited and not on CISA KEV as of 22 October 2026, 20:17 BST. A full public write-up by security researchers appeared on 20 October, so expect attempts soon.
Security researchers publish a full technical write-up of the flaw.
GLPI 11.0.9 released with the fix. Advisory GHSA-753w-2942-4pxm, no CVE assigned yet.
Not reported exploited, not on CISA KEV.
Upgrade every GLPI instance, restrict internet exposure and hunt for planning.php abuse.
What to Do in the Next 24 Hours
Proactive on the left. Reactive on the right. Tick both tracks.
Upgrade and restrict
- Find every GLPI instance you or your clients run, including internet-facing ones.
- Upgrade to GLPI 11.0.9 or later.
- Put GLPI behind VPN or an IP allowlist if it does not need to be public.
- Back up the database before and after upgrading.
Hunt for abuse
- Search web logs for anonymous requests to front/planning.php with both genical and checkavailability.
- Review GLPI for new admin accounts and new API tokens.
- Check for unexpected files or plugins on the server.
- If you find abuse: isolate, preserve logs, rotate credentials, run incident response.
Proactive: Upgrade and Reduce Exposure
GLPI is widely used by MSPs for helpdesk and asset management and is often internet-facing. Treat every exposed instance as urgent.
Find every GLPI instance
List every GLPI server across your business and every client, with its version and whether it is reachable from the internet. Check the version under Setup, General, or in the footer.
Upgrade to 11.0.9 or later
Take a database and file backup, then upgrade to GLPI 11.0.9 or later from the official GLPI releases page. Versions 11.0.8 and earlier are affected.
Restrict access
If GLPI does not need to be public, put it behind VPN or an IP allowlist. Until you can upgrade, block requests to front/planning.php that carry both genical and checkavailability at your reverse proxy or WAF.
Free Checker Scripts
Built by the CybaVerse threat hunt team. Run them on every GLPI server you or your clients run to get a clear verdict and evidence.
check_glpi.sh / check_glpi.ps1
Reads the local GLPI version from the install directory (and optionally the GLPI console) and reports whether it is fixed. It never sends traffic to the application.
bash check_glpi.sh /var/www/glpi
pwsh -File check_glpi.ps1 -GlpiDir 'C:\inetpub\wwwroot\glpi'scan_logs.sh + DB review
Scans Apache, Nginx and IIS access logs for requests to planning.php carrying both genical and checkavailability. Includes read-only SQL to review recently created admins and API tokens.
bash scan_logs.sh /var/log/nginx /var/log/apache2
mysql -u readonly -p glpi < db_review_queries.sqlRead-only by design
The checkers only read local files and logs. They never send exploit traffic or change GLPI. Upgrading and resetting accounts stay with you. Review any script before you run it.
Verdicts
- PATCHEDGLPI not installed, or version 11.0.9 or later.
- LIKELY VULNERABLEGLPI 11.x below 11.0.9. Upgrade now and run the log hunt.
- UNKNOWNVersion unreadable, or a pre-11 branch. The researchers say GLPI 10 is not exploitable this way, but confirm and keep it supported.
- ERRORThe check failed, so the result is unknown.
Exit codes
| Code | Meaning |
|---|---|
| 0 | PATCHED / no log hits |
| 1 | LIKELY VULNERABLE / log hits |
| 2 | UNKNOWN |
| 3 | ERROR |
MSPs and internal IT teams can use the exit code in RMM or deployment tooling to flag hosts at scale.
Know the limits
- A log hit on the parameter names is not proof of a successful attack, and a clean scan does not rule one out.
- The KQL has not been run on a live tenant. Validate field names for your connectors.
- No CVE or published GitHub advisory yet. Recheck when they appear.
Reactive: How to Hunt
Because the full details are public, assume an internet-facing instance on 11.0.8 or earlier may have been probed. CybaOps can run these hunts across your estate or your clients'.
planning.php requests
Search web server and proxy logs for requests to front/planning.php containing both genical and checkavailability, especially without an authenticated session.
grep -E "planning\.php.*(genical.*checkavailability|checkavailability.*genical)" /var/log/apache2/access.log* /var/log/nginx/access.log*Admin accounts and API tokens
Review GLPI users with Super-Admin or Admin profiles and API tokens for anything new or unexpected. Check database records for recently created users and changed passwords.
Respond
If you find abuse, isolate the server, preserve logs and the database, reset all GLPI passwords and API tokens, rotate any credentials stored in GLPI, and run incident response.
Detection pack: KQL and Sigma
Hunts from the CybaVerse threat hunt team for Microsoft Sentinel (CommonSecurityLog, W3CIISLog, Syslog and App Service HTTP logs) and a Sigma web server rule, all matching requests to planning.php with both parameters. Run them in CybaOps or your own SIEM.
The only disclosed indicator is the parameter combination, so no IP or hash IOCs are included. The KQL has not been run on a live tenant.
KQL hunting queries (Sentinel and Defender XDR)
Loading queries. If they don't appear, download the full pack below. The .kql file is inside it.Sigma: planning.php with genical and checkavailability
title: GLPI Planning.php genical and checkavailability Parameter Combination
id: 7c3e9a12-5b84-4d1f-9e2a-0a6f4c8d1b27
status: experimental
description: >
Detects HTTP requests to GLPI front/planning.php that include both genical and
checkavailability query parameters. Per the GHSA-753w-2942-4pxm disclosure
(researcher write-up / GLPI 11.0.9 security release), this combination bypasses
rights and CSRF/token checks before reaching checkAvailability(), enabling
unauthenticated SQL injection on affected GLPI 11.0.0-11.0.8. This rule does
not validate exploit payloads; presence of both parameters is the hunt signal.
references:
- https://github.com/glpi-project/glpi/releases/tag/11.0.9
author: detection-pack
date: 2026-10-22
level: high
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_path:
- cs-uri-stem|contains: 'planning.php'
- c-uri|contains: 'planning.php'
- uri|contains: 'planning.php'
- request|contains: 'planning.php'
- url|contains: 'planning.php'
selection_genical:
- cs-uri-query|contains|all:
- 'genical'
- 'checkavailability'
- c-uri|contains|all:
- 'genical'
- 'checkavailability'
- uri|contains|all:
- 'genical'
- 'checkavailability'
- request|contains|all:
- 'genical'
- 'checkavailability'
- query|contains|all:
- 'genical'
- 'checkavailability'
- url|contains|all:
- 'genical'
- 'checkavailability'
condition: selection_path and selection_genical
falsepositives:
- Legitimate calendar/availability features that intentionally set both parameters
(uncommon for anonymous clients; review authenticated sessions separately)
- Vulnerability scanners replaying the disclosed parameter names
fields:
- cs-uri-stem
- cs-uri-query
- c-ip
- cs-method
- sc-statusGLPI FAQ
Short answers as of 22 October 2026.
Which GLPI versions are affected?
GLPI 11.0.8 and earlier. Upgrade to 11.0.9 or later.
Is GLPI 10 affected?
The researchers say GLPI 10 is not exploitable through this injection path. The flaw affects GLPI 11.0.8 and earlier on the 11.x line. Upgrade to 11.0.9 or later.
Is there a CVE?
Not yet. It is tracked as GHSA-753w-2942-4pxm, but the GitHub advisory page is not yet published. The fix is listed in the GLPI 11.0.9 release notes.
Is it being exploited?
It is not reported exploited and is not on CISA KEV as of 22 October 2026, 20:17 BST. A full public write-up appeared on 20 October, so attempts are expected.
What can an attacker do?
Read the whole GLPI database without logging in, which can lead to admin takeover and possible remote code execution.
Detect and Remediate GLPI Exposure Across Your Estate
CybaOps monitors your endpoints, servers and applications, whether that's your own business or your clients'. Our SOC runs these threat hunts, alerts on suspicious activity and drives remediation through to a verified fix, so proactive checks and reactive response happen in one place.