CVE-2014-3829

displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 fixed in Centreon web 2.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 sessionid or 2 templateid parameter, related to the commandline variable...

CVE-2014-3829

Centreon 2.5.1 and Centreon Enterprise Server 2.2 are vulnerable to unauthenticated command injection via displayServiceStatus.php, exploiting shell metacharacters in the session_id or template_id parameters (related to the command_line variable). The issue, CVE-2014-3829, is noted as fixed in Ce...

CVE-2014-3828

Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 fixed in Centreon web 2.5.3 allow remote attackers to execute arbitrary SQL commands via 1 the indexid parameter to views/graphs/common/makeXMLListMetrics.php, 2 the sid parameter to...

CVE-2014-3828

Centreon 2.5.1 and Centreon Enterprise Server 2.2 contain SQL injection vulnerabilities (CVE-2014-3828) that are pre-auth and remotely exploitable. The issues arise in multiple PHP components where unsanitized input is used: index_id (views/graphs/common/makeXML_ListMetrics.php), sid (views/graph...

Centreon SQL / Command Injection

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Centreon SQL and Command Injection', 'Description' = %q This module exploits several vulnerabilities on Centreon 2.5.1 and prior and...

Centreon SQL Injection / Command Injection

Multiple unauthenticated SQL injections and unauthenticated remote command injection in Centreon SQL injections: ------------------ POST http://server/centreon/include/configuration/configObject/traps/GetXMLTrapsForVendor.php POST DATA mnftrid=1 or 1=1 union all select version,2 -- / POST...

Centreon SQL Injection / Command Injection Vulnerability

Centreon SQL InjectioCentreon versions 2.5.2 and below and Centreon Enterprise Server versions 2.2 and below and 3.0 and below suffer from remote SQL injection and remote command injection vulnerabilities.n / Command Injection Multiple unauthenticated SQL injections and unauthenticated remote...

Centreon Server Detection

Binary data 8559.prm...

Centreon contains multiple vulnerabilities

Overview Centreon version 2.5.1 and Centreon Enterprise Server version 2.2 contain multiple vulnerabilities. Description CWE-77: Improper Neutralization of Special Elements used in a Command 'Command Injection' - CVE-2014-3829 Centreon version 2.5.1 and Centreon Enterprise Server version 2.2 are...

Centreon < 2.5.1 / Centreon Enterprise Server < 2.2 - SQL Injection / Command Injection (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Centreon SQL and Command Injection', 'Description' = %q This module exploits several vulnerabilities on Centreon 2.5.1 and prio...

Centreon SQL and Command Injection

This module exploits several vulnerabilities on Centreon 2.5.1 and prior and Centreon Enterprise Server 2.2 and prior. Due to a combination of SQL injection and command injection in the displayServiceStatus.php component, it is possible to execute arbitrary commands as long as there is a valid...

Oreon 1.4 / Centreon 1.4.1 - Multiple RFI Vulnerabilties

No description provided by source. By Michael Brooks Vulnerability Type: Multiple Remote File Inclusion. Software: Oreon and Centreon Homepage:http://www.oreon-project.org/ or http://www.centreon.com/ Versions: 1.4Oreon and 1.4.1Centreon The vulnerable file is:...

Centreon Enterprise Server 2.3.3-2.3.9-4 - Blind SQL Injection Exploit

No description provided by source. !/usr/bin/env python Exploit Title: Centreon 2.3.3 - 2.3.9-4 menuXML.php Blind SQL Injection Exploit Disclosure Date: December 12, 2012 Author: modpr0be @modpr0be Platform: Linux Tested on: Centreon Enterprise Server with Centreon 2.3.9-4 on CentOS 5.5 x8664 Fin...

Centreon IT & Network Monitoring 2.1.5 - Injection SQL

No description provided by source. !/usr/bin/perl //--------PoC---------// Title : Centreon IT & Network Monitoring v2.1.5 - Injection SQL Version : 2.1.5 Author : Jonathan Salwan [email protected] Vuln sql injection http://localhost/centreon/main.php?p=201&hostid=-1%20SQL Injection&o=p&min=1...

Centreon <= 1.4.2.3 (get_image.php) Remote File Disclosure Exploit

No description provided by source. !/usr/bin/python Date : 20/01/2008 Author : Julien CAYSSOL [email protected] import sys, urllib2,re useragent = 'Mozilla/6.0 compatible; MSIE 6.0; Windows NT' headers = 'User-Agent' : useragent , 'Accept-Charset' : 'ISO-8859-15' if name == main: if lensys.argv==2:...

Centreon 1.4.2.3 - index.php Local File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/28052/info Centreon is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. Exploiting this issue may allow an attacker to obtain potentially sensitive information that ma...

[SECURITY] Fedora 19 Update: nagstamon-0.9.9-9.fc19

Nagstamon is a Nagios status monitor which takes place in system tray or on desktop GNOME, KDE, Windows as floating status bar to inform you in real-time about the status of your Nagios and derivatives monitored network. It allows to connect to multiple Nagios, Icinga, Opsview, Op5,...

CVE-2012-5967

SQL injection vulnerability in menuXML.php in Centreon 2.3.3 through 2.3.9-4 fixed in Centreon web 2.6.0 allows remote authenticated users to execute arbitrary SQL commands via the menu parameter...

Sql injection

SQL injection vulnerability in menuXML.php in Centreon 2.3.3 through 2.3.9-4 fixed in Centreon web 2.6.0 allows remote authenticated users to execute arbitrary SQL commands via the menu parameter...

CVE-2012-5967

Centreon 2.3.3 through 2.3.9-4 contains a blind SQL injection in menuXML.php via the menu parameter. Exploitation requires an authenticated remote user and can lead to arbitrary SQL execution against the back-end DB. The issue is mitigated by upgrading to Centreon Web 2.6.0 or Centreon 2.4.0+ (pe...