CVE-2014-3828

60Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 73%

from disclosure to weapon0 days

Published on NVDOct 23

1st PoCOct 15

metasploitOct 15

exploitation probability

73%top 1% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allow remote attackers to execute arbitrary SQL commands via (1) the index_id parameter to views/graphs/common/makeXML_ListMetrics.php, (2) the sid parameter to views/graphs/GetXmlTree.php, (3) the session_id parameter to views/graphs/graphStatus/displayServiceStatus.php, (4) the mnftr_id parameter to configuration/configObject/traps/GetXMLTrapsForVendor.php, or (5) the index parameter to common/javascript/commandGetArgs/cmdGetExample.php in include/.

Affected products

n/a · n/a

public PoCs found — 2

exploitdbwww.exploit-db.com/exploits/41676unverified exploitdbwww.exploit-db.com/exploits/35078unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.5/centreon-2.5.3.html http://seclists.org/fulldisclosure/2014/Oct/78 https://github.com/centreon/centreon/commit/cc2109804dd69057cb209037113796ec5ffdce90#diff-e328097503b14fbb117e0db798aefcde http://www.kb.cert.org/vuls/id/298796 http://www.securityfocus.com/bid/70648