Exploitation Summary
EIP tracks 1 public exploit for CVE-2020-36947. PoCs published by Hodorsec.
AI-analyzed exploit summary This exploit demonstrates an authenticated SQL injection vulnerability in LibreNMS 1.46 via the MAC Accounting Graph feature. It uses time-based blind SQLi to extract user credentials from the database.
Description
LibreNMS 1.46 contains an authenticated SQL injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database information. Attackers can exploit the vulnerability by manipulating the 'sort' parameter with crafted SQL injection techniques to retrieve sensitive database contents through time-based blind SQL injection.
Exploits (1)
This exploit demonstrates an authenticated SQL injection vulnerability in LibreNMS 1.46 via the MAC Accounting Graph feature. It uses time-based blind SQLi to extract user credentials from the database.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N