CVE-2023-40931
MEDIUM NUCLEINagios XI 5.11.0-5.11.1 - Authenticated SQL Injection via Banner Message ID Parameter
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2023-40931. PoCs published by sealldeveloper, G4sp4rCS, datboi6942. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository provides a functional SQL injection exploit for CVE-2023-40931 using sqlmap, targeting Nagios XI's banner_message-ajaxhelper.php endpoint. The exploit requires valid credentials and leverages an authenticated SQLi vulnerability to dump the xi_users table.
Description
A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/banner_message-ajaxhelper.php
Exploits (3)
This repository provides a functional SQL injection exploit for CVE-2023-40931 using sqlmap, targeting Nagios XI's banner_message-ajaxhelper.php endpoint. The exploit requires valid credentials and leverages an authenticated SQLi vulnerability to dump the xi_users table.
This repository contains a functional PoC for CVE-2023-40931, targeting Nagios XI. The exploit demonstrates SQL injection via the 'id' parameter in the banner_message-ajaxhelper.php endpoint and includes functionality to create an admin account and attempt a reverse shell.
This Python script demonstrates an authenticated SQL injection vulnerability in Nagios XI by leveraging a vulnerable endpoint to dump database contents using sqlmap. It includes authentication, session handling, and a proof-of-concept SQLi payload.
Nuclei Templates (1)
title:"Nagios XI"
app="nagios-xi"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N