CVE-2019-12279

CRITICAL

Nagios XI 5.6.1 - SQL Injection via Username Parameter in Password Reset Form

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-12279. PoCs published by JameelNabbo.

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in Nagios XI's login.php forgot password functionality. The POC shows how an attacker can inject malicious SQL queries via the username parameter to potentially bypass authentication or extract sensitive data.

Description

Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form). NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that can be done with the variable provided, and while the username value being passed does get used in a SQL query, it is passed through SQL escaping functions when creating the call. The vendor tried re-creating the issue with no luck

Exploits (1)

exploitdb WORKING POC

by JameelNabbo · textwebappsphp

https://www.exploit-db.com/exploits/46910

View Code ZIP pw:eip

This exploit demonstrates a SQL injection vulnerability in Nagios XI's login.php forgot password functionality. The POC shows how an attacker can inject malicious SQL queries via the username parameter to potentially bypass authentication or extract sensitive data.

Classification

Working Poc 90%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: Nagios XI xi-5.6.1

No auth needed

Prerequisites: Access to the Nagios XI login page · Network connectivity to the target server

MITRE ATT&CK

T1189 - Drive-by Compromise T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3

Core References

Exploit, Third Party Advisory x_refsource_misc

https://github.com/JameelNabbo/exploits/blob/master/nagiosxi%20username%20sql%20injection.txt

View Exploit ZIP pw:eip

Exploit, Third Party Advisory x_refsource_misc

http://packetstormsecurity.com/files/153040/Nagios-XI-5.6.1-SQL-Injection.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/108446

Scores

CVSS v3 9.8

EPSS 0.0422

EPSS Percentile 89.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-89

Status published

Products (1)

nagios/nagios_xi 5.6.1

Published May 22, 2019

Tracked Since Feb 18, 2026