SQL Injection in LibreNMS

An issue was discovered in LibreNMS 1.50.1. A SQL injection flaw was identified in the ajaxrulesuggest.php file where the term parameter is used insecurely in a database query for showing columns of a table, as demonstrated by an ajaxrulesuggest.php?debug=1&term= request...

GHSA-878X-85HC-GC4G SQL Injection in LibreNMS

An issue was discovered in LibreNMS 1.50.1. A SQL injection flaw was identified in the ajaxrulesuggest.php file where the term parameter is used insecurely in a database query for showing columns of a table, as demonstrated by an ajaxrulesuggest.php?debug=1&term= request...

GHSA-R336-JXFR-4C3C Path Traversal in LibreNMS

An issue was discovered in LibreNMS 1.50.1. An authenticated user can perform a directory traversal attack against the /pdf.php file with a partial filename in the report parameter, to cause local file inclusion resulting in code execution...

Path Traversal in LibreNMS

An issue was discovered in LibreNMS 1.50.1. An authenticated user can perform a directory traversal attack against the /pdf.php file with a partial filename in the report parameter, to cause local file inclusion resulting in code execution...

Exposure of Sensitive Information to an Unauthorized Actor in LibreNMS

An issue was discovered in LibreNMS through 1.47. Information disclosure can occur: an attacker can fingerprint the exact code version installed and disclose local file paths...

GHSA-F4HH-XXQH-WGPQ Exposure of Sensitive Information to an Unauthorized Actor in LibreNMS

An issue was discovered in LibreNMS through 1.47. Information disclosure can occur: an attacker can fingerprint the exact code version installed and disclose local file paths...

Improper Encoding or Escaping of Output and Injection in LibreNMS

An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.php do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqlirealescapestring,...

GHSA-W5R2-GVGF-MPM8 Improper Encoding or Escaping of Output and Injection in LibreNMS

An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.php do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqlirealescapestring,...

GHSA-277V-GWFR-HMPJ Missing Authentication for Critical Function in LibreNMS

An issue was discovered in LibreNMS through 1.47. A number of scripts import the Authentication libraries, but do not enforce an actual authentication check. Several of these scripts disclose information or expose functions that are of a sensitive nature and are not expected to be publicly...

Missing Authentication for Critical Function in LibreNMS

An issue was discovered in LibreNMS through 1.47. A number of scripts import the Authentication libraries, but do not enforce an actual authentication check. Several of these scripts disclose information or expose functions that are of a sensitive nature and are not expected to be publicly...

Directory Traversal

librenms/librenms is vulnerable to directory traversal. The usage of mysqlrealescapestring to sanitize untrusted user supplied data that is subsequently passed to the include function as a file path in csv.php, is insecure. An attacker could potentially include arbitrary files on the server using...

Cross-Site Scripting (XSS)

librenms/librenms is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the string parameter in /pages/inventory.inc.php...

OS Command Injection

LibreNMS is vulnerable to OS command injection. It does not properly validate the user input via the graphing options html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php, allowing an attacker to inject any RRDtool commands such as cd and ls via html/graph.php script...

Information Disclosure

librenms is vulnerable to information disclosure. The attack exists because it does not prevent the user from fingerprinting the exact code installed to get local file paths...

SQL Injection

librenms/librenms is vulnerable to SQL injection. A remote attacker is able to inject and execute arbitrary SQL statements via the searchPhrase parameter in ajaxtable.php...

OS Command Injection

librenms/librenms is vulnerable to OS command injection. A remote attacker is able to inject arbitrary OS commands through the RRDtool via the graphtitle parameter...

Authentication Bypass

librenms/librenms is vulnerable to authentication bypass. The attack is possible when authentication libraries are imported but not used for authentication check...

Local File Inclusion

librenms/librenms is vulnerable to local file inclusion. The usage of mysqlrealescapestring in pdf.php to sanitize file paths is insecure. Due to the usage of include that takes in untrusted user-supplied data to include scripts, a remote attacker could potentially include arbitrary scripts to be...

SQL Injection

librenms/librenms is vulnerable to SQL injection. The function mysqlrealeascapestring in ajaxrulesuggest.php is inadequate in sanitizing SQL queries, allowing an authenticated attacker to inject and execute arbitrary SQL statements via the term parameter...

LibreNMS Code Injection Vulnerability

LibreNMS is an open source network monitoring system based on PHP and MySQL. The system features customizable alerts , auto-discovery of the network environment and automatic updates . A code injection vulnerability exists in LibreNMS version 1.50.1, which can be exploited by an attacker to...