CVE-2018-11589

Vulnerability

Multiple SQL injection vulnerabilities exist in Centreon 3.4.6, including Centreon Web 2.8.23. Injection occurs via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId parameter in ExportCSVServiceData.php, the searchCurve parameter in listComponentTemplates.php, and the host_id parameter in makeXML_ListMetrics.php [1]. No authentication or special configuration is required to reach the affected code paths.

Exploitation

An attacker can send crafted HTTP GET or POST requests to any of the vulnerable endpoints, supplying malicious SQL in the respective parameter. The only requirement is network access to the Centreon web interface [1]. No prior authentication or user interaction is needed.

Impact

Successful exploitation allows the attacker to execute arbitrary SQL commands against the Centreon database. This can result in unauthorized disclosure of sensitive data, including user credentials, configuration details, and monitoring information [1]. The attacker gains read access to the full database contents but does not directly achieve remote code execution or file modification on the server.

Mitigation

Centreon patched these vulnerabilities in a later release, but the specific fixed version is not disclosed in the provided references [1]. Organizations should upgrade to the latest Centreon version. As a workaround, restrict network access to the Centreon web interface and validate or sanitize the affected input parameters in a Web Application Firewall (WAF). No known exploitation in the wild (KEV) listing exists at this time.