CVE-2018-10737

HIGHNuclei

Nagios Nagios XI Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2018-10737 has a selected CVSS score of 7.2 (high); EIP currently links 1 Nuclei template.

Description

A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/logbook.php txtSearch parameter.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Nov 14, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Nagios XI

Browse Nagios / Nagios XI
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryHIGHNagiosXI <= 5.4.12 logbook.php SQL injectionCVSS 7.2

A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/logbook.php txtSearch parameter.

Impact

Authenticated administrators can execute arbitrary SQL commands to access, modify, or delete database contents, potentially compromising the entire Nagios XI instance.

Remediation

Upgrade to Nagios XI version 5.4.13 or later.

WeaknessesCWE-89
AuthorsDhiyaneshDK
Template tagscvecve2018nagiossqlivkevvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*
Shodan: http.title:"nagios xi"
FOFA: app="Nagios-XI"
FOFA: title="nagios xi"
FOFA: app="nagios-xi"
Google: intitle:"nagios xi"
https://vulners.com/seebug/SSV:97267 https://nvd.nist.gov/vuln/detail/CVE-2018-10737

Source: ProjectDiscovery

References

2