---
id: 9223
title: "[CVE-2023-28838] GLPI - SQL injection through dynamic reports"
cve: CVE-2023-28838
source_domain: yokai.hakaisecurity.io
source_url: "https://yokai.hakaisecurity.io/glpi-dynamic-reports-vulnerability/"
published_at: "2024-01-15T15:00:00Z"
tags: ["rce", "vulnerability-research", "sql-injection", "research"]
phying_url: "https://phying.com/item/9223"
lang: en
---

# [CVE-2023-28838] GLPI - SQL injection through dynamic reports

## Summary

This post details the journey of our Research Team in uncovering a SQL Injection vulnerability in GLPI, an open-source ITSM tool predominantly used in Brazil and France. We observed many companies using GLPI, and we decided to focus on finding vulnerabilities that could allow access to users’ credentials and potentially some Remote Code Execution (RCE) […]

## Intelligence Metadata

- **Sources:** yokai.hakaisecurity.io
- **CVE:** CVE-2023-28838
- **Published:** 2024-01-15T15:00:00Z
- **Original:** https://yokai.hakaisecurity.io/glpi-dynamic-reports-vulnerability/
- **Phying News:** https://phying.com/item/9223