Login Request a demo
High severity · published Aug 21, 2024
CVE-2024-5725
Centreon initCurveList SQL Injection Remote Code Execution Vulnerability
8.8
CVSS
47.4%
EPSS
No
On KEV
Description
Centreon initCurveList SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the initCurveList function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the apache user. Was ZDI-CAN-22683.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)47.4% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Centreon · Centreon
23.10.3 · source: vendor, CISA
CW
Centreon Web · Centreon
before 22.10.23; 23.04.0 before 23.04.19; 23.10.0 before 23.10.13; 24.04.0 before 24.04.3 · source: NVD
Affected product
CE
Centreon
Centreon
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-5725
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-5725
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-597/
Patch
https://thewatch.centreon.com/latest-security-bulletins-64/security-bulletin-for-centreon-web-3744
More from Centreon
9.8
CVE-2024-32501
A SQL Injection vulnerability exists in the updateServiceHost functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x…
9.8
CVE-2022-3827
centreon Contact Groups Form formContactGroup.php sql injection
9.8
CVE-2021-37558
A SQL injection vulnerability in a MediaWiki script in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote unauthenticated attackers to execute arbitrary SQL commands via…
9.8
CVE-2019-17647
An issue was discovered in Centreon before 2.8.30, 18.10.8, 19.04.5, and 19.10.2
9.8
CVE-2018-21024
licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request