Exploitation Summary
EIP tracks 1 public exploit for CVE-2015-1561. PoCs published by Huy-Ngoc DAU.
AI-analyzed exploit summary The document describes two vulnerabilities in Centreon 2.5.4 and prior: an unauthenticated blind SQL injection (CVE-2015-1560) and an authenticated remote command execution (CVE-2015-1561). It includes PoC URLs for both vulnerabilities, demonstrating how an attacker can exploit them to gain control of the web server.
Description
The escape_command function in include/Administration/corePerformance/getStats.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in Centreon 19.10.0) uses an incorrect regular expression, which allows remote authenticated users to execute arbitrary commands via shell metacharacters in the ns_id parameter.
Exploits (1)
The document describes two vulnerabilities in Centreon 2.5.4 and prior: an unauthenticated blind SQL injection (CVE-2015-1560) and an authenticated remote command execution (CVE-2015-1561). It includes PoC URLs for both vulnerabilities, demonstrating how an attacker can exploit them to gain control of the web server.