CVE-2020-35700

A second-order SQL injection issue in Widgets/TopDevicesController.php aka the Top Devices dashboard widget of LibreNMS before 21.1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the sortorder parameter against the /ajax/form/widget-settings endpoint...

LibreNMS SQL注入漏洞

Librenms is an open source network monitoring system based on PHP and MySQL from the Librenms community. The system features customizable alerts, auto-discovery of the network environment and automatic updates. A SQL injection vulnerability exists in LibreNMS versions prior to 21.1.0, which...

LibreNMS 1.46 SQL Injection

Exploit Title: LibreNMS 1.46 - MAC Accounting Graph Authenticated SQL Injection Google Dork: Unknown Date: 13-12-2020 Exploit Author: Hodorsec Vendor Homepage: https://www.librenms.org Software Link: https://github.com/librenms/librenms Update notice:...

LibreNMS 1.46 - MAC Accounting Graph Authenticated SQL Injection

Exploit Title: LibreNMS 1.46 - MAC Accounting Graph Authenticated SQL Injection Google Dork: Unknown Date: 13-12-2020 Exploit Author: Hodorsec Vendor Homepage: https://www.librenms.org Software Link: https://github.com/librenms/librenms Update notice:...

Exploit for SQL Injection in Librenms

CVE-2020-15873 Proof of Concept of CVE-2020-15873 - Blind SQL...

LibreNMS SQL Injection Vulnerability (CNVD-2020-41858)

LibreNMS is an open source network monitoring system based on PHP and MySQL. The system features customizable alerts , auto-discovery of the network environment and automatic updates . A SQL injection vulnerability exists in LibreNMS versions prior to 1.65.1. The vulnerability stems from a lack o...

CVE-2020-15877

An issue was discovered in LibreNMS before 1.65.1. It has insufficient access control for normal users because of "'guard' = 'admin'" instead of "'middleware' = 'can:admin'" in routes/web.php...

CVE-2020-15873

In LibreNMS before 1.65.1, an authenticated attacker can achieve SQL Injection via the customoid.inc.php deviceid POST parameter to ajaxform.php...

CVE-2020-15877

An issue was discovered in LibreNMS before 1.65.1. It has insufficient access control for normal users because of "'guard' = 'admin'" instead of "'middleware' = 'can:admin'" in routes/web.php...

CVE-2020-15873

In LibreNMS before 1.65.1, an authenticated attacker can achieve SQL Injection via the customoid.inc.php deviceid POST parameter to ajaxform.php...

Sql injection

In LibreNMS before 1.65.1, an authenticated attacker can achieve SQL Injection via the customoid.inc.php deviceid POST parameter to ajaxform.php...

Improper access control

An issue was discovered in LibreNMS before 1.65.1. It has insufficient access control for normal users because of "'guard' = 'admin'" instead of "'middleware' = 'can:admin'" in routes/web.php...

CVE-2020-15877

CVE-2020-15877 affects LibreNMS prior to 1.65.1, where normal users may gain elevated access due to insufficient access control caused by using 'guard' => 'admin' instead of the proper middleware pattern 'middleware' => ['can:admin'] in routes/web.php. The issue has been reported across mul...

CVE-2020-15877

An issue was discovered in LibreNMS before 1.65.1. It has insufficient access control for normal users because of "'guard' = 'admin'" instead of "'middleware' = 'can:admin'" in routes/web.php...

CVE-2020-15873

LibreNMS before 1.65.1 is affected by a SQL injection vulnerability that can be triggered by an authenticated user via the customoid.inc.php device_id POST parameter to ajax_form.php. The root cause is insufficient validation of SQL statements, enabling an attacker to craft inputs that alter quer...

CVE-2020-15873

In LibreNMS before 1.65.1, an authenticated attacker can achieve SQL Injection via the customoid.inc.php deviceid POST parameter to ajaxform.php...

LibreNMS 1.46 - 'search' SQL Injection

Exploit Title: LibreNMS 1.46 - 'search' SQL Injection Google Dork:unknown Date: 2019-09-01 Exploit Author: Punt Vendor Homepage: https://www.librenms.org Software Link: https://www.librenms.org Version:1.46 and less Tested on:Linux and Windows CVE: N/A Affected Device: more than 4k found on Shoda...

LibreNMS 1.46 SQL Injection

Exploit Title: LibreNMS 1.46 - 'search' SQL Injection Google Dork:unknown Date: 2019-09-01 Exploit Author: Punt Vendor Homepage: https://www.librenms.org Software Link: https://www.librenms.org Version:1.46 and less Tested on:Linux and Windows CVE: N/A Affected Device: more than 4k found on Shoda...

LibreNMS 1.46 - (search) SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: LibreNMS 1.46 - 'search' SQL Injection Google Dork:unknown Exploit Author: Punt Vendor Homepage: https://www.librenms.org Software Link: https://www.librenms.org Version:1.46 and less Tested on:Linux and Windows CVE: N/A Affecte...

SQL Injection in LibreNMS

An issue was discovered in LibreNMS through 1.47. It does not parameterize all user supplied input within database queries, resulting in SQL injection. An authenticated attacker can subvert these database queries to extract or manipulate data, as demonstrated by the graph.php sort parameter...