Lucene search

PRIOn knowledge basePRION:CVE-2023-40931

HistorySep 19, 2023 - 11:15 p.m.

Sql injection

2023-09-1923:15:00

PRIOn knowledge base

www.prio-n.com

sql injection

nagios xi

version 5.11.0

version 5.11.1

authenticated attackers

arbitrary sql commands

id parameter

post request

banner_message-ajaxhelper.php

nvd

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.4%

JSON

A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/banner_message-ajaxhelper.php

CPENameOperatorVersion
nagios_xige5.11.0
nagios_xilt5.11.2

CPE	Name	Operator	Version
	nagios_xi	ge	5.11.0
	nagios_xi	lt	5.11.2

References

nagios.com

outpost24.com/blog/nagios-xi-vulnerabilities/

www.nagios.com/products/security/