CVE-2019-20197
HIGHNagios XI 5.6.9 - Authenticated OS Command Injection via schedulereport.php id Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2019-20197. PoCs published by jas502n, lp008.
AI-analyzed exploit summary This repository contains a functional proof-of-concept exploit for CVE-2019-20197, a remote command execution vulnerability in Nagios XI <= v5.6.9. The exploit leverages command injection via the 'id' parameter in the schedulereport.php component, allowing an attacker to execute arbitrary commands on the target system.
Description
In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account.
Exploits (2)
This repository contains a functional proof-of-concept exploit for CVE-2019-20197, a remote command execution vulnerability in Nagios XI <= v5.6.9. The exploit leverages command injection via the 'id' parameter in the schedulereport.php component, allowing an attacker to execute arbitrary commands on the target system.
The repository contains a functional proof-of-concept exploit for CVE-2019-20197, a remote command execution vulnerability in Nagios XI. The exploit leverages command injection via the 'id' parameter in a POST request to execute arbitrary commands on the target system.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H