In glpi prior to 9.5.1, there is a SQL injection for all usages of "Clone" feature. This has been fixed in 9.5.1.
glpi-project glpi