CVE-2023-48084

CRITICALNuclei

Nagios Nagios XI Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Title source: VulnCheck
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-48084 has a selected CVSS score of 9.8 (critical); EIP currently links 3 repository PoCs and 1 Nuclei template.

Description

Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 7, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
3
Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 28, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Nagios XI

Browse Nagios / Nagios XI
VulnCheckVersion data not supplied

Proofs of concept

3

Repository PoCs

GitHubMettHK/CVE-2023-48084-RevisedRepository PoCby MettHK0Exploit4 files

16.8 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2023-48084, a time-based blind SQL injection vulnerability in Nagios XI, to extract database schemas, tables, columns, and data. It uses binary search and multithreading for efficient data exfiltration.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python script (CVE-2023-48084.py), a README.md, and a requirements.txt file. The script implements a time-based blind SQL injection exploit against Nagios XI for CVE-2023-48084. It uses binary search and multithreading to extract database schema, tables, columns, and data. No backdoor, trojan, or deceptive behavior was observed. The script performs only the advertised SQL injection and data extraction; it does not establish persistence, exfiltrate data to an unrelated third party, download or execute secondary payloads, or conceal any hidden functionality.

ClassificationExploit
Model confidence98%
AuthenticationRequired
LanguagesPython
Target softwareNagios XI
Attack typesSQL Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Python script that actively exploits a SQL injection vulnerability to extract data from a target database. It constructs malicious SQL payloads, sends them to the vulnerable endpoint, and interprets the time-based responses to exfiltrate information. This is the definition of an exploit.

CVE-2023-48084.py:1-373README.md:1-90

Requirements

  • Requires a valid Nagios XI session cookie or API token for authentication.CVE-2023-48084.py:266-296
  • Target must be running a vulnerable version of Nagios XI (before 5.11.3).README.md:16

Observed behavior

  • Sends HTTP GET requests to the vulnerable endpoint '/admin/banner_message-ajaxhelper.php' with a time-based SQL injection payload in the 'id' parameter.CVE-2023-48084.py:52CVE-2023-48084.py:117-121
  • Uses a binary search algorithm to determine the length of SQL query results and the ASCII value of each character, minimizing the number of requests.CVE-2023-48084.py:109-130CVE-2023-48084.py:133-150
  • Employs multithreading to extract multiple characters in parallel, speeding up the data exfiltration process.CVE-2023-48084.py:153-186
  • Provides an interactive menu to discover and select database schemas, tables, and columns, or allows direct specification via command-line arguments.CVE-2023-48084.py:216-251
  • Dumps the selected data from the database and displays it to the user.CVE-2023-48084.py:210-213CVE-2023-48084.py:254-258
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThe script sends crafted HTTP GET requests with SLEEP() payloads to extract database information. This is the normal and expected behavior for a PoC targeting CVE-2023-48084.CVE-2023-48084.py:52CVE-2023-48084.py:87-99CVE-2023-48084.py:109-130CVE-2023-48084.py:133-150
Data Extraction
Payload withheldThe script provides functions to enumerate and dump database contents, which is the core purpose of the PoC. No data is sent anywhere other than the target server.CVE-2023-48084.py:189-213
Network Communication
Payload withheldAll network requests are directed to the base URL provided by the user via the -u argument. There are no hardcoded external URLs, callbacks, or data exfiltration endpoints.CVE-2023-48084.py:102-106CVE-2023-48084.py:265
Dependency
Payload withheldThe script imports only standard library modules and the well-known requests library. pwntools is optional and used only for progress display. No obfuscated or suspicious imports are present.CVE-2023-48084.py:12-20requirements.txt:1-2
Review boundaries

What the analysis did not establish

  • The evidence includes a complete, readable Python script and documentation, but one file (likely a license or .gitignore) was omitted from the text content. This does not affect the classification.
  • The analysis is based solely on the provided source code and documentation; the code was not executed, and its effectiveness or safety is not verified.
  • One file in the repository (unclassified, 214 bytes) was not provided as text and was flagged as metadata-only. Its content is unknown, but it is not the main exploit script and is unlikely to contain backdoor behavior given the artifact's nature.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubHamibubu/CVE-2023-48084Repository PoCby Hamibubu1Not analyzed3 files

11.2 KiB

GitHub
PoC details
GitHubbucketcat/CVE-2023-48084Repository PoCby bucketcat0Not analyzed35 files

46.2 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryCRITICALNagios XI < 5.11.3 - SQL InjectionCVSS 9.8

SQL injection vulnerability in Nagios XI before version 5.11.3 via the bulk modification tool.

Impact

Successful exploitation could lead to unauthorized access to sensitive information.

Remediation

Apply the vendor-supplied patch or upgrade to a non-vulnerable version.

WeaknessesCWE-89
Authorsritikchaddha
Template tagstime-based-sqlicvecve2023nagiosxisqliauthenticatednagiosvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*
Shodan: http.title:"nagios xi"
FOFA: title="Nagios XI"
FOFA: title="nagios xi"
FOFA: app="nagios-xi"
Google: intitle:"nagios xi"
https://github.com/bucketcat/CVE-2023-48084 https://github.com/Hamibubu/CVE-2023-48084 https://nvd.nist.gov/vuln/detail/CVE-2023-48084 https://github.com/nomi-sec/PoC-in-GitHub

Source: ProjectDiscovery

References

2