GHSA-2j4g-v4fv-rhwg

Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-23118

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	centreon/centreon	< 22.10.15	22.10.15

Details

As written in the advisory (Markdown source, shown as plain text).

Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateContactHostCommands function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-22298.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-23118 advisory
https://github.com/centreon/centreon/pull/2464 web
https://github.com/centreon/centreon/commit/c6ee0f67544a70524539b26e8ea92209676a5399 web
https://github.com/centreon/centreon package
https://www.zerodayinitiative.com/advisories/ZDI-24-114 web