GHSA-22v7-v3mj-pm8r

Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-0637

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	centreon/centreon	< 22.10.15	22.10.15

Details

As written in the advisory (Markdown source, shown as plain text).

Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateDirectory function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-22294.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-0637 advisory
https://github.com/centreon/centreon/pull/2464 web
https://github.com/centreon/centreon/commit/c6ee0f67544a70524539b26e8ea92209676a5399 web
https://github.com/centreon/centreon web
https://www.zerodayinitiative.com/advisories/ZDI-24-118 web