title: GLPI Planning.php genical and checkavailability Parameter Combination
id: 7c3e9a12-5b84-4d1f-9e2a-0a6f4c8d1b27
status: experimental
description: >
  Detects HTTP requests to GLPI front/planning.php that include both genical and
  checkavailability query parameters. Per the GHSA-753w-2942-4pxm disclosure
  (researcher write-up / GLPI 11.0.9 security release), this combination bypasses
  rights and CSRF/token checks before reaching checkAvailability(), enabling
  unauthenticated SQL injection on affected GLPI 11.0.0-11.0.8. This rule does
  not validate exploit payloads; presence of both parameters is the hunt signal.
references:
  - https://github.com/glpi-project/glpi/releases/tag/11.0.9
author: detection-pack
date: 2026-10-22
level: high
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_path:
    - cs-uri-stem|contains: 'planning.php'
    - c-uri|contains: 'planning.php'
    - uri|contains: 'planning.php'
    - request|contains: 'planning.php'
    - url|contains: 'planning.php'
  selection_genical:
    - cs-uri-query|contains|all:
        - 'genical'
        - 'checkavailability'
    - c-uri|contains|all:
        - 'genical'
        - 'checkavailability'
    - uri|contains|all:
        - 'genical'
        - 'checkavailability'
    - request|contains|all:
        - 'genical'
        - 'checkavailability'
    - query|contains|all:
        - 'genical'
        - 'checkavailability'
    - url|contains|all:
        - 'genical'
        - 'checkavailability'
  condition: selection_path and selection_genical
falsepositives:
  - Legitimate calendar/availability features that intentionally set both parameters
    (uncommon for anonymous clients; review authenticated sessions separately)
  - Vulnerability scanners replaying the disclosed parameter names
fields:
  - cs-uri-stem
  - cs-uri-query
  - c-ip
  - cs-method
  - sc-status