CVE-2024-32480 LibreNMS's Time-Based Blind SQL injection leads to database extraction

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Versions prior to 24.4.0 are vulnerable to SQL injection. The order parameter is obtained from $request. After performing a string check, the value is directly incorporated into an SQL statement and concatenated, resultin...

CVE-2024-32480 LibreNMS's Time-Based Blind SQL injection leads to database extraction

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Versions prior to 24.4.0 are vulnerable to SQL injection. The order parameter is obtained from $request. After performing a string check, the value is directly incorporated into an SQL statement and concatenated, resultin...

CVE-2024-32479 LibreNMS's Improper Sanitization on Service template name leads to Stored XSS

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Prior to version 24.4.0, there is improper sanitization on the Service template name, which can lead to stored Cross-site Scripting. Version 24.4.0 fixes this vulnerability...

CVE-2024-32479 LibreNMS's Improper Sanitization on Service template name leads to Stored XSS

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Prior to version 24.4.0, there is improper sanitization on the Service template name, which can lead to stored Cross-site Scripting. Version 24.4.0 fixes this vulnerability...

CVE-2024-32479

CVE-2024-32479 affects LibreNMS prior to version 24.4.0, where improper sanitization of the Service template name enables stored XSS. The issue arises in the Service template handling (delete button onclick context), allowing attacker-controlled input to be stored and later rendered as script. Th...

CVE-2024-32479 LibreNMS's Improper Sanitization on Service template name leads to Stored XSS

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Prior to version 24.4.0, there is improper sanitization on the Service template name, which can lead to stored Cross-site Scripting. Version 24.4.0 fixes this vulnerability...

CVE-2024-32461 LibreNMS vulnerable to time-based SQL injection that leads to database extraction

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A SQL injection vulnerability in POST /search/search=packages in LibreNMS prior to version 24.4.0 allows a user with global read privileges to execute SQL commands via the package parameter. With this vulnerability, an...

CVE-2024-32461 LibreNMS vulnerable to time-based SQL injection that leads to database extraction

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A SQL injection vulnerability in POST /search/search=packages in LibreNMS prior to version 24.4.0 allows a user with global read privileges to execute SQL commands via the package parameter. With this vulnerability, an...

CVE-2024-32461

LibreNMS exposes a SQL injection in the endpoint POST /search/search=packages, affecting versions prior to 24.4.0. The vulnerability allows a user with global read privileges to execute SQL commands via the package parameter and perform a time-based attack to exfiltrate data from the database (e....

CVE-2024-32461 LibreNMS vulnerable to time-based SQL injection that leads to database extraction

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A SQL injection vulnerability in POST /search/search=packages in LibreNMS prior to version 24.4.0 allows a user with global read privileges to execute SQL commands via the package parameter. With this vulnerability, an...

GHSA-JH57-J3VQ-H438 LibreNMS vulnerable to a Time-Based Blind SQL injection leads to database extraction

Summary Get a valid API token, make sure you can access api functions, then replace string on my PoC code, Test on offical OVA image, it's a old version 23.9.1, but this vulerable is also exists on latest version 24.2.0 Details in file apifunctions.php, line 307 for function listdevices php $orde...

LibreNMS vulnerable to a Time-Based Blind SQL injection leads to database extraction

Summary Get a valid API token, make sure you can access api functions, then replace string on my PoC code, Test on offical OVA image, it's a old version 23.9.1, but this vulerable is also exists on latest version 24.2.0 Details in file apifunctions.php, line 307 for function listdevices php $orde...

GHSA-72M9-7C8X-PMMW LibreNMS uses Improper Sanitization on Service template name leads to Stored XSS

Summary There is improper sanitization on Service template name which is reflecting in delete button onclick event. This value can be modified and crafted as any other javascript code. Vulnerable Code...

GHSA-CWX6-CX7X-4Q34 LibreNMS vulnerable to SQL injection time-based leads to database extraction

Summary SQL injection vulnerability in POST /search/search=packages in LibreNMS 24.3.0 allows a user with global read privileges to execute SQL commands via the package parameter. Details There is a lack of hygiene of data coming from the user in line 83 of the file...

LibreNMS vulnerable to SQL injection time-based leads to database extraction

Summary SQL injection vulnerability in POST /search/search=packages in LibreNMS 24.3.0 allows a user with global read privileges to execute SQL commands via the package parameter. Details There is a lack of hygiene of data coming from the user in line 83 of the file...

PT-2024-24604 · Librenms · Librenms

Name of the Vulnerable Software and Affected Versions: LibreNMS versions prior to 24.4.0 Description: The issue is related to a SQL injection vulnerability. The order parameter, obtained from $request, is directly incorporated into an SQL statement after a string check, resulting in the...

LibreNMS 安全漏洞

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of network environments and automatic updates. A security vulnerability exists in LibreNMS versions prior to 24.4.0, which stems from a...

LibreNMS 安全漏洞

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of network environments and automatic updates. A security vulnerability exists in LibreNMS versions prior to 24.4.0 that stems from the...

LibreNMS SQL注入漏洞

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of network environments, and automatic updates. A security vulnerability exists in LibreNMS versions prior to 24.4.0. An attacker...

PT-2024-24590

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 24.4.0 Description A SQL injection vulnerability in the POST /search/search=packages endpoint in LibreNMS allows a user with global read privileges to execute SQL commands via the package parameter. This vulnerabilit...