Centreon 2.5.4 - Multiple Vulnerabilities

Exploit for php platform in category web applications Merethis Centreon - Unauthenticated blind SQLi and Authenticated Remote Command Execution CVEs: CVE-2015-1560, CVE-2015-1561 Vendor: Merethis - www.centreon.com Product: Centreon Version affected: 2.5.4 and prior Product description: Centreon ...

Centreon 2.5.4 - Multiple Vulnerabilities

Merethis Centreon - Unauthenticated blind SQLi and Authenticated Remote Command Execution CVEs: CVE-2015-1560, CVE-2015-1561 Vendor: Merethis - www.centreon.com Product: Centreon Version affected: 2.5.4 and prior Product description: Centreon is the choice of some of the world's largest companies...

Cacti monitoring system injection vulnerability trigger the bloodshed-vulnerability warning-the black bar safety net

Preface: Security is a whole, any one of the short Board will cause Safety accident, from the border network to the IDC operation and maintenance of the network to the office network, are the whole of each of the network cannot be ignored. Enterprise in for security to do a multi-layer protection...

Centreon 'insertLog()' Function RCE

The Centreon application hosted on the remote web server is affected by a remote code execution vulnerability due to a failure to properly sanitize user-supplied input before using it in a SQL query. The application uses the 'echo' system command with the PHP exec function which allows a remote,...

Centreon < 2.5.4 Multiple Vulnerabilities

According to its version number, the Centreon application hosted on the remote web server is affected by multiple vulnerabilities : - A SQL injection vulnerability exists in the centreonLog.class.php script due to improper sanitization of user-supplied input to the 'username' parameter. A remote...

Centreon Detection

Binary data centreondetect.nbin...

Centreon Default Administrator Password

The remote Centreon install uses a default set of credentials 'admin' / 'centreon' to control access to its management interface. An attacker can leverage this issue to gain administrative access to the application. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Centreon < 2.5.3 Multiple Vulnerabilities

According to its version number, the Centreon application hosted on the remote web server is affected by multiple vulnerabilities : - Multiple unauthenticated SQL injection vulnerabilities. CVE-2014-3828 - A remote, unauthenticated command injection vulnerability in the 'sessionid' and 'templatei...

Centreon 2.3.3 < 2.4.0 menuXML.php 'menu' Parameter SQL Injection

According to its version number, the Centreon application hosted on the remote web server is affected by a SQL injection vulnerability in the 'menu' parameter of the 'menuXML.php' script. A remote, authenticated user could potentially exploit this issue to execute arbitrary SQL statements against...

Default Password (centreon) for 'root' Account

The account 'root' on the remote host has the default password 'centreon'. An attacker can leverage this issue to gain administrative access to the affected system. Note that Centreon Enterprise Server is known to use these credentials to provide complete, administrative access to the virtual...

Centreon GetXMLTrapsForVendor.php 'mnftr_id' Parameter SQLi

The Centreon application installed on the remove host is affected by a SQL injection vulnerability because the application fails to properly sanitize user-supplied input to the 'mnftrid' parameter of the 'GetXMLTrapsForVendor.php' script. A remote, unauthenticated attacker can exploit this issue ...

Centreon <= 2.5.3 Multiple Vulnerabilities - Active Check

Centreon is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:centreon:centreon"; ifdescription...

Centreon SQL and Command Injection

Merethis Centreon 2.5.1版本和Centreon Enterprise Server 2.2版本中存在SQL注入漏洞，该漏洞源于以下脚本没有充分过滤参数： views/graphs/common/makeXMLListMetrics.php脚本没有充分过滤‘indexid’参数； views/graphs/GetXmlTree.php脚本没有充分过滤‘sid’参数；...

Centreon <= 2.5.1, Centreon Enterprise Server <= 2.2 Multiple SQLi Vulnerabilities

Centreon and Centreon Enterprise Server are prone to multiple SQL injection SQLi vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...

Centreon - SQL Injection / Command Injection (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Centreon SQL and Command Injection', 'Description' = %q This module exploits several vulnerabilities on Centreon 2.5.1 and prior and...

Centreon SQL / Command Injection Exploit

This Metasploit module exploits several vulnerabilities on Centreon 2.5.1 and prior and Centreon Enterprise Server 2.2 and prior. Due to a combination of SQL injection and command injection in the displayServiceStatus.php component, it is possible to execute arbitrary commands as long as there is...

CVE-2014-3828

Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 fixed in Centreon web 2.5.3 allow remote attackers to execute arbitrary SQL commands via 1 the indexid parameter to views/graphs/common/makeXMLListMetrics.php, 2 the sid parameter to...

CVE-2014-3829

displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 fixed in Centreon web 2.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 sessionid or 2 templateid parameter, related to the commandline variable...

Sql injection

Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 fixed in Centreon web 2.5.3 allow remote attackers to execute arbitrary SQL commands via 1 the indexid parameter to views/graphs/common/makeXMLListMetrics.php, 2 the sid parameter to...

Design/Logic Flaw

displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 fixed in Centreon web 2.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 sessionid or 2 templateid parameter, related to the commandline variable...