OS Command Injection

LibreNMS is vulnerable to OS command injection. It does not properly validate the user input via the graphing options html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php, allowing an attacker to inject any RRDtool commands such as cd and ls via html/graph.php script...

Information Disclosure

librenms is vulnerable to information disclosure. The attack exists because it does not prevent the user from fingerprinting the exact code installed to get local file paths...

SQL Injection

librenms/librenms is vulnerable to SQL injection. A remote attacker is able to inject and execute arbitrary SQL statements via the searchPhrase parameter in ajaxtable.php...

OS Command Injection

librenms/librenms is vulnerable to OS command injection. A remote attacker is able to inject arbitrary OS commands through the RRDtool via the graphtitle parameter...

Authentication Bypass

librenms/librenms is vulnerable to authentication bypass. The attack is possible when authentication libraries are imported but not used for authentication check...

Local File Inclusion

librenms/librenms is vulnerable to local file inclusion. The usage of mysqlrealescapestring in pdf.php to sanitize file paths is insecure. Due to the usage of include that takes in untrusted user-supplied data to include scripts, a remote attacker could potentially include arbitrary scripts to be...

SQL Injection

librenms/librenms is vulnerable to SQL injection. The function mysqlrealeascapestring in ajaxrulesuggest.php is inadequate in sanitizing SQL queries, allowing an authenticated attacker to inject and execute arbitrary SQL statements via the term parameter...

LibreNMS Code Injection Vulnerability

LibreNMS is an open source network monitoring system based on PHP and MySQL. The system features customizable alerts , auto-discovery of the network environment and automatic updates . A code injection vulnerability exists in LibreNMS version 1.50.1, which can be exploited by an attacker to...

LibreNMS Directory Traversal Vulnerability

LibreNMS is a PHP/MYSQL/SNMP-based open source monitoring tool . A directory traversal vulnerability exists in /pdf.php in LibreNMS 1.50.1, which can be exploited by an attacker to gain access to locations outside of a restricted directory...

LibreNMS Authentication Bypass Vulnerability

LibreNMS is a PHP/MYSQL/SNMP-based open source monitoring tool . An authentication bypass vulnerability exists in LibreNMS 1.47 and earlier versions, which can be exploited by an attacker to access multiple scripts...

LibreNMS Information Disclosure Vulnerability

LibreNMS is a PHP/MYSQL/SNMP-based open source monitoring tool . An information disclosure vulnerability exists in LibreNMS 1.47 and earlier versions, which can be exploited by an attacker to identify the exact code version installed and obtain local file paths...

LibreNMS SQL Injection Vulnerability (CNVD-2019-32206)

LibreNMS is a PHP/MYSQL/SNMP-based open source monitoring tool . A SQL injection vulnerability exists in LibreNMS 1.47 and earlier versions, which can be exploited by an authenticated attacker to corrupt database queries to extract or manipulate data...

LibreNMS Cross-Site Scripting Vulnerability (CNVD-2019-32207)

LibreNMS is a PHP/MYSQL/SNMP-based open source monitoring tool . A cross-site scripting vulnerability exists in LibreNMS 1.47 and earlier versions, which can be exploited by attackers to execute client-side code...

LibreNMS SQL Injection Vulnerability (CNVD-2019-32210)

LibreNMS is a PHP/MYSQL/SNMP-based open source monitoring tool . An SQL injection vulnerability exists in ajaxrulesuggest.php in LibreNMS 1.50.1, which can be exploited by an authenticated attacker to corrupt database queries in order to extract or manipulate data...

LibreNMS - Collectd Command Injection (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'LibreNMS Collectd Command Injection', 'Description' = %q This module exploits a command injection vulnerability in the Collectd graphing...

CVE-2019-10671

An issue was discovered in LibreNMS through 1.47. It does not parameterize all user supplied input within database queries, resulting in SQL injection. An authenticated attacker can subvert these database queries to extract or manipulate data, as demonstrated by the graph.php sort parameter...

CVE-2019-12463

An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.php do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqlirealescapestring,...

CVE-2019-10670

An issue was discovered in LibreNMS through 1.47. Many of the scripts rely on the function mysqliescaperealstring for filtering data. However, this is particularly ineffective when returning user supplied input in an HTML or a JavaScript context, resulting in unsafe data being injected into these...

CVE-2019-12463

An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.php do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqlirealescapestring,...

CVE-2019-12465

An issue was discovered in LibreNMS 1.50.1. A SQL injection flaw was identified in the ajaxrulesuggest.php file where the term parameter is used insecurely in a database query for showing columns of a table, as demonstrated by an ajaxrulesuggest.php?debug=1&term= request...