GLPI - SQLi (CVE-2019-10232)

CVE-2019-10232 is a high-severity vulnerability affecting Teclib GLPI, allowing SQL injection through improper handling of inputs to a script used to unlock tasks.

CrowdSec has been tracking this vulnerability and its exploits since 26th of March 2025.

CrowdSec network observations suggest that most exploitation of CVE-2019-10232 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. CrowdSec network telemetry also shows that exploitation of CVE-2019-10232 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Observed attacks typically involve requests to URLs containing /scripts/unlock_tasks.php.