Russian Vulnerability Scanner Database

Back to List

CVE-2014-3828

Scores

EPSS

0.786medium78.6%
0%20%40%60%80%100%

Percentile: 78.6%

CVSS

10.0critical2.0
0246810

CVSS Score: 10.0/10

All CVSS Scores

CVSS 2.0
10.0

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Description

Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allow remote attackers to execute arbitrary SQL commands via (1) the index_id parameter to views/graphs/common/makeXML_ListMetrics.php, (2) the sid parameter to views/graphs/GetXmlTree.php, (3) the session_id parameter to views/graphs/graphStatus/displayServiceStatus.php, (4) the mnftr_id parameter to configuration/configObject/traps/GetXMLTrapsForVendor.php, or (5) the index parameter to common/javascript/commandGetArgs/cmdGetExample.php in include/.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

nvd

CWEs

CWE-89

Exploits

Exploit ID: 35078

Source: exploitdb

URL: https://www.exploit-db.com/exploits/35078

Exploit ID: 41676

Source: exploitdb

URL: https://www.exploit-db.com/exploits/41676

Recommendations

Source: nvd

The CERT/CC is currently unaware of a practical solution to this problem.

URL: http://www.kb.cert.org/vuls/id/298796

Vulnerable Software (2)

Type: Configuration

Vendor: merethis

Product: centreon

Operating System: * * *

Trait: 
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:merethis:centreon:2.5.1:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:merethis:centreon_enterprise_server:2.2...

Source: nvd

Type: Configuration

Vendor: merethis

Product: centreon_enterprise_server

Operating System: * * *

Trait: 
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:merethis:centreon:2.5.1:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:merethis:centreon_enterprise_server:2.2...

Source: nvd