Arbitrary OS Command Execution

librenms is vulnerable to arbitrary OS command execution. The vulnerability exists due to the lack of validation of user's input to gensnmpwalkcmd in capture.inc.php, allowing an attacker to control the output passed to popen command to inject and execute arbitrary OS commands...

Design/Logic Flaw

LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $POST'community' parameter to html/pages/addhost.inc.php during creation of a new device, and then making a /ajaxoutput.php?id=capture&format=text&type=snmpwalk&hostname=localhost request that triggers...

CVE-2018-20434 - LibreNMS Addhost Command Injection

LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $POST'community' parameter to html/pages/addhost.inc.php during creation of a new device, and then making a /ajaxoutput.php?id=capture&format=text&type=snmpwalk&hostname=localhost request that triggers...