CVE-2025-3872

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon centreon-web (User configuration form modules) allows SQL Injection.


A user with high privileges is able to become administrator by intercepting the contact form request and altering its payload.



This issue affects Centreon: from 22.10.0 before 22.10.28, from 23.04.0 before 23.04.25, from 23.10.0 before 23.10.20, from 24.04.0 before 24.04.10, from 24.10.0 before 24.10.4.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CentreonCNA
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 6%
VendorProductVersion
centreoncentreon_web
22.10.0 ≤
𝑥
< 22.10.28
centreoncentreon_web
23.04.0 ≤
𝑥
< 23.04.25
centreoncentreon_web
23.10.0 ≤
𝑥
< 23.10.20
centreoncentreon_web
24.04.0 ≤
𝑥
< 24.04.10
centreoncentreon_web
24.10.0 ≤
𝑥
< 24.10.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/centreon/centreon/releases
https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-55571-centreon-web-high-severity-4496