critical9.8Public exploit code
CVE-2018-8734
SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Nagios XI 5.2.6-5.4.12 - Chained Remote Code Execution (Metasploit)2018-07-02 · remote · linux · Verified
- Nagios XI 5.2.6 < 5.2.9 / 5.3 / 5.4 - Chained Remote Root2018-04-30 · webapps · php · Verified
Impact
SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nagios | Nagios Xi | from 5.2.0 before 5.4.13 |
Weakness classification
References
- NVD record
- CVE.org record
- https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT
- https://blog.redactedsec.net/exploits/2018/04/26/nagios.html
- https://gist.github.com/caleBot/f0a93b5a98574393e0139104eacc2d0f
- https://www.exploit-db.com/exploits/44560/
- https://www.exploit-db.com/exploits/44969/
- https://www.nagios.com/downloads/nagios-xi/change-log/
- https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT
- https://blog.redactedsec.net/exploits/2018/04/26/nagios.html
- https://gist.github.com/caleBot/f0a93b5a98574393e0139104eacc2d0f
- https://www.exploit-db.com/exploits/44560/
- https://www.exploit-db.com/exploits/44969/
- https://www.nagios.com/downloads/nagios-xi/change-log/