Exploitation Summary
EIP tracks 2 public exploits for CVE-2026-2751. PoCs published by hakaioffsec, XZ1r0.
AI-analyzed exploit summary The repository contains functional exploit code for multiple Centreon vulnerabilities (CVE-2026-2749, CVE-2026-2750, CVE-2026-2751), including path traversal to RCE, command injection via CLAPI, and blind SQL injection. Each exploit is well-structured with clear arguments and verification steps.
Description
Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dependencies modules) allows Blind SQL Injection.This issue affects Centreon Web on Central Server before 25.10.8, 24.10.20, 24.04.24.
Exploits (2)
The repository contains functional exploit code for multiple Centreon vulnerabilities (CVE-2026-2749, CVE-2026-2750, CVE-2026-2751), including path traversal to RCE, command injection via CLAPI, and blind SQL injection. Each exploit is well-structured with clear arguments and verification steps.
This is a functional blind SQL injection exploit for Centreon <= 25.10.6 (CVE-2026-2751). It leverages unsanitized array keys in Service Dependencies to extract data via time-based SQLi, supporting both credential dumping and custom query execution.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L