Centreon GetXmlTree.php 'sid' Parameter SQLi

The Centreon application running on the remote host is affected by a SQL injection SQLi vulnerability in the isUserAdmin function due to improper sanitization of user-supplied input to the 'sid' parameter of the GetXmlTree.php script. An unauthenticated, remote attacker can exploit this issue, vi...

PT-2015-5349

Name of the Vulnerable Software and Affected Versions Centreon versions prior to 2.7.0 Description A SQL injection issue exists in the isUserAdmin function, allowing remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the sid parameter in the...

CVE-2015-1560: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the isUserAdmin function in include/common/common-Func.php in Centreon formerly Merethis Centreon 2.5.4 and earlier fixed in Centreon web 2.7.0 allows remote attackers to execute arbitrary SQL commands via the sid parameter to include/common/XmlTree/GetXmlTree.php...

CVE-2014-3828: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 fixed in Centreon web 2.5.3 allow remote attackers to execute arbitrary SQL commands via 1 the indexid parameter to views/graphs/common/makeXMLListMetrics.php, 2 the sid parameter to...