Exploitation Summary
EIP tracks 3 public exploits for CVE-2026-2750. PoCs published by hakaioffsec, TreasureBoy520, XZ1r0.
AI-analyzed exploit summary The repository contains functional exploit code for multiple Centreon vulnerabilities (CVE-2026-2749, CVE-2026-2750, CVE-2026-2751), including path traversal leading to RCE, command injection via CLAPI, and blind SQL injection. Each exploit is well-structured with clear arguments, session handling, and verification steps.
Description
Improper Input Validation vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centreon Open Tickets modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10; 24.10;24.04.
Exploits (3)
The repository contains functional exploit code for multiple Centreon vulnerabilities (CVE-2026-2749, CVE-2026-2750, CVE-2026-2751), including path traversal leading to RCE, command injection via CLAPI, and blind SQL injection. Each exploit is well-structured with clear arguments, session handling, and verification steps.
This exploit leverages an OS command injection vulnerability in Centreon's CLAPI `generatetraps` action via improperly sanitized input in the MIB file path. The PoC uploads a crafted MIB file with a command injection payload and triggers it through the `passthru()` function in the `generatetraps` endpoint.
This Python script exploits CVE-2026-2750, a command injection vulnerability in Centreon's CLAPI generatetraps functionality. It uploads a malicious MIB file via the open-tickets module and triggers command execution through the CLAPI endpoint.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H