CVE-2019-12279

22.05.2019, 16:29

Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form). NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that can be done with the variable provided, and while the username value being passed does get used in a SQL query, it is passed through SQL escaping functions when creating the call. The vendor tried re-creating the issue with no luck

SQL Injection

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitre	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 95%

Vendor	Product	Version
nagios	nagios_xi	5.6.1

𝑥

= Vulnerable software versions

Known Exploits!

Common Weakness Enumeration

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

References

http://packetstormsecurity.com/files/153040/Nagios-XI-5.6.1-SQL-Injection.html

http://www.securityfocus.com/bid/108446

https://github.com/JameelNabbo/exploits/blob/master/nagiosxi%20username%20sql%20injection.txt

http://packetstormsecurity.com/files/153040/Nagios-XI-5.6.1-SQL-Injection.html

http://www.securityfocus.com/bid/108446

https://github.com/JameelNabbo/exploits/blob/master/nagiosxi%20username%20sql%20injection.txt