Centreon 2.5.1 and Centreon Enterprise Server 2.2 contain multiple SQL injection flaws in several web components, including graph views, trap configuration and command argument scripts, with the affected endpoints identified as makeXML_ListMetrics.php, GetXmlTree.php, displayServiceStatus.php, GetXMLTrapsForVendor.php and cmdGetExample.php.
Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allow remote attackers to execute arbitrary SQL commands via (1) the index_id parameter to views/graphs/common/makeXML_ListMetrics.php, (2) the sid parameter to views/graphs/GetXmlTree.php, (3) the session_id parameter to views/graphs/graphStatus/displayServiceStatus.php, (4) the mnftr_id parameter to configuration/configObject/traps/GetXMLTrapsForVendor.php, or (5) the index parameter to common/javascript/commandGetArgs/cmdGetExample.php in include/.
Public exploit code (Exploit-DB) was available 8 days before disclosure.
remote SQL injection against public-facing web application
allow remote attackers to execute arbitrary SQL commands via
arbitrary SQL command execution on database backend
allow remote attackers to execute arbitrary SQL commands
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2014-3828 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
DomainTools cannot make a definitive determination, based on these details it appears that the intruder likely used a vulnerability such as CVE-2014-3828, a SQL injection vulnerability in Centreon patched in version 2.5.3, to write data to the vulnerable system (such as a webshell) which could facilitate…