Ryukk33

**Name of the Vulnerable Software and Affected Versions** DataInjection plugin for GLPI version 2.15.6 **Description** An authenticated user with access to the data injection feature can perform a time-based blind SQL injection. This occurs because the plugin concatenates user-supplied CSV field values directly into SQL queries during the CSV import process without using parameterization or escaping. An attacker can embed SQL expressions, such as `SLEEP()`, within a mapped field like `Serial Number` to manipulate the query and extract sensitive database information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.