Description
Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.24) allows SQL Injection via the searchVM parameter to the main.php?p=20408 URI.
References (5)
Core 5
Core References
Issue Tracking x_refsource_confirm
https://github.com/centreon/centreon/pull/6257
Exploit, Third Party Advisory x_refsource_misc
http://www.roothc.com.br/1349-2/
Various Sources x_refsource_confirm
https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8/centreon-2.8.24.html
Various Sources x_refsource_confirm
https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10/centreon-18.10.0.html
Issue Tracking x_refsource_confirm
https://github.com/centreon/centreon/pull/6628
Scores
CVSS v3
8.8
EPSS
0.0193
EPSS Percentile
77.8%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-89
Status
published
Products (2)
centreon/centreon
18.0.0 - 18.10.0Packagist
centreon/centreon
3.4.0 - 3.4.9
Published
Nov 16, 2018
Tracked Since
Feb 18, 2026