PT-2015-5349

Name of the Vulnerable Software and Affected Versions Centreon versions prior to 2.7.0 Description A SQL injection issue exists in the isUserAdmin function, allowing remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the sid parameter in the...

Merethis Centreon - Unauthenticated blind SQLi and Authenticated Remote Command Execution

Merethis Centreon - Unauthenticated blind SQLi and Authenticated Remote Command Execution CVEs: CVE-2015-1560, CVE-2015-1561 Vendor: Merethis - www.centreon.com Product: Centreon Version affected: 2.5.4 and prior Product description: Centreon is the choice of some of the world's largest companies...

Merethis Centreon 'isUserAdmin()' Function SQL Injection Vulnerability

Merethis Centreon is an open source IT monitoring software from Merethis France that needs to be paired with Nagios to manage Nagios via the web web and to enable monitoring of networks, operating systems and applications via third-party components. A SQL injection vulnerability exists in Merethi...

Centreon 2.5.4 - Multiple Vulnerabilities

Centreon 2.5.4 - Multiple Vulnerabilities Merethis Centreon - Unauthenticated blind SQLi and Authenticated Remote Command Execution CVEs: CVE-2015-1560, CVE-2015-1561 Vendor: Merethis - www.centreon.com Product: Centreon Version affected: 2.5.4 and prior Product description: Centreon is the choic...

Centreon 2.5.4 - Multiple Vulnerabilities

Exploit for php platform in category web applications Merethis Centreon - Unauthenticated blind SQLi and Authenticated Remote Command Execution CVEs: CVE-2015-1560, CVE-2015-1561 Vendor: Merethis - www.centreon.com Product: Centreon Version affected: 2.5.4 and prior Product description: Centreon ...

Merethis Centreon 2.5.4 SQL Injection / Remote Command Execution

Merethis Centreon - Unauthenticated blind SQLi and Authenticated Remote Command Execution CVEs: CVE-2015-1560, CVE-2015-1561 Vendor: Merethis - www.centreon.com Product: Centreon Version affected: 2.5.4 and prior Product description: Centreon is the choice of some of the world's largest companies...

Centreon 2.5.4 - Multiple Vulnerabilities

Merethis Centreon - Unauthenticated blind SQLi and Authenticated Remote Command Execution CVEs: CVE-2015-1560, CVE-2015-1561 Vendor: Merethis - www.centreon.com Product: Centreon Version affected: 2.5.4 and prior Product description: Centreon is the choice of some of the world's largest companies...

Cacti monitoring system injection vulnerability trigger the bloodshed-vulnerability warning-the black bar safety net

Preface: Security is a whole, any one of the short Board will cause Safety accident, from the border network to the IDC operation and maintenance of the network to the office network, are the whole of each of the network cannot be ignored. Enterprise in for security to do a multi-layer protection...

Centreon < 2.5.4 Multiple Vulnerabilities

According to its version number, the Centreon application hosted on the remote web server is affected by multiple vulnerabilities : - A SQL injection vulnerability exists in the centreonLog.class.php script due to improper sanitization of user-supplied input to the 'username' parameter. A remote...

Centreon 'insertLog()' Function RCE

The Centreon application hosted on the remote web server is affected by a remote code execution vulnerability due to a failure to properly sanitize user-supplied input before using it in a SQL query. The application uses the 'echo' system command with the PHP exec function which allows a remote,...

Centreon 2.3.3 < 2.4.0 menuXML.php 'menu' Parameter SQL Injection

According to its version number, the Centreon application hosted on the remote web server is affected by a SQL injection vulnerability in the 'menu' parameter of the 'menuXML.php' script. A remote, authenticated user could potentially exploit this issue to execute arbitrary SQL statements against...

Centreon < 2.5.3 Multiple Vulnerabilities

According to its version number, the Centreon application hosted on the remote web server is affected by multiple vulnerabilities : - Multiple unauthenticated SQL injection vulnerabilities. CVE-2014-3828 - A remote, unauthenticated command injection vulnerability in the 'sessionid' and 'templatei...

Centreon Detection

Binary data centreondetect.nbin...

Centreon Default Administrator Password

The remote Centreon install uses a default set of credentials 'admin' / 'centreon' to control access to its management interface. An attacker can leverage this issue to gain administrative access to the application. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Centreon GetXMLTrapsForVendor.php 'mnftr_id' Parameter SQLi

The Centreon application installed on the remove host is affected by a SQL injection vulnerability because the application fails to properly sanitize user-supplied input to the 'mnftrid' parameter of the 'GetXMLTrapsForVendor.php' script. A remote, unauthenticated attacker can exploit this issue ...

Default Password (centreon) for 'root' Account

The account 'root' on the remote host has the default password 'centreon'. An attacker can leverage this issue to gain administrative access to the affected system. Note that Centreon Enterprise Server is known to use these credentials to provide complete, administrative access to the virtual...

Centreon <= 2.5.3 Multiple Vulnerabilities - Active Check

Centreon is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:centreon:centreon"; ifdescription...

Centreon SQL and Command Injection

Merethis Centreon 2.5.1版本和Centreon Enterprise Server 2.2版本中存在SQL注入漏洞，该漏洞源于以下脚本没有充分过滤参数： views/graphs/common/makeXMLListMetrics.php脚本没有充分过滤‘indexid’参数； views/graphs/GetXmlTree.php脚本没有充分过滤‘sid’参数；...

Centreon <= 2.5.1, Centreon Enterprise Server <= 2.2 Multiple SQLi Vulnerabilities

Centreon and Centreon Enterprise Server are prone to multiple SQL injection SQLi vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...

Centreon - SQL Injection / Command Injection (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Centreon SQL and Command Injection', 'Description' = %q This module exploits several vulnerabilities on Centreon 2.5.1 and prior and...