Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability

🗓️ 02 Apr 2024 00:30:46Reported by GitHub Advisory DatabaseType

Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability This allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateLCARelation function due to the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the service account.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2024-23116	11 Feb 202413:06	–	circl
CNNVD	Centreon 安全漏洞	1 Apr 202400:00	–	cnnvd
CVE	CVE-2024-23116	1 Apr 202421:47	–	cve
Cvelist	CVE-2024-23116 Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability	1 Apr 202421:47	–	cvelist
NVD	CVE-2024-23116	1 Apr 202422:15	–	nvd
OSV	GHSA-J4PC-VQVC-4P9X Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability	2 Apr 202400:30	–	osv
Positive Technologies	PT-2024-19673 · Centreon · Centreon	9 Feb 202400:00	–	ptsecurity
Veracode	SQL Injection	8 Apr 202406:13	–	veracode
Vulnrichment	CVE-2024-23116 Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability	1 Apr 202421:47	–	vulnrichment
Zero Day Initiative	Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability	9 Feb 202400:00	–	zdi

Vulners

Node

centreon centreonRange<22.10.15composer

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-23116
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-24-116
github	www.github.com/centreon/centreon/pull/2464
github	www.github.com/centreon/centreon/commit/c6ee0f67544a70524539b26e8ea92209676a5399
github	www.github.com/advisories/GHSA-j4pc-vqvc-4p9x

02 Apr 2024 14:41Current

9High risk

Vulners AI Score9

CVSS 37.2

EPSS0.86031

SSVC

CWE-89