High severity8.8NVD Advisory· Published Aug 21, 2024· Updated Jun 17, 2026

CVE-2024-5725

Description

Centreon initCurveList SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability.

The specific flaw exists within the initCurveList function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the apache user. Was ZDI-CAN-22683.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Centreon/Centreon Web
cpe:2.3:a:centreon:centreon_web:*:*:*:*:*:*:*:*
Range: <22.10.23
Centreon/Centreonllm-fuzzy2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: 23.10.3

Patches

Vulnerability mechanics

References

thewatch.centreon.com/latest-security-bulletins-64/security-bulletin-for-centreon-web-3744nvdPatchVendor Advisory
www.zerodayinitiative.com/advisories/ZDI-24-597/nvdThird Party AdvisoryVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.038
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000