NagiosXI-RCE-all-version-CVE-2021-40345

NagiosXI RCE 文件上传 CVE-2021-40345 已验证的 RFI 到 RCE 的 Nagios/NagiosXI 利用 步骤 1： 进入“dashlets”管理页面，下载其中一个（我以“rssdashlet”为例）： root@kitploit: http://TARGETIP/nagiosxi/admin/dashlets.php?download=rssdashlet 步骤 2： 修改 .inc.php 文件（我以第 34 行插入一个简单的 PHP 反向 shell 单行命令为例）： 步骤 3： 启动监听器，并在 dashlets 管理页面上传恶意 dashlet：...

Nagios XI Command Injection (CVE-2021-40345)

A command injection vulnerability exists in Nagios Xi. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

CVE-2021-40345

CVE-2021-40345 affects Nagios XI 5.8.5. In the Admin panel’s Manage Dashlets, an administrator-uploaded ZIP can trigger a command injection via the name of the first file in the archive, enabling execution of system commands. Several sources document authenticated command-injection abuse (includi...