In glpi before 9.5.1, there is a SQL injection for all usages of «Clone» feature. This has been fixed in 9.5.1.
