CVE-2020-15875: SQL Injection
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the searchPhrase parameter in the /ajaxtable.php API endpoint. This affects as-selection.inc.php, edit-ports.inc.php, alertlog-stats.inc.php, alerts.inc.php, eventlog.inc.php, inventory.inc.php, ix-list.inc.php, ix-peers.inc.php, mempool-edit.inc.php, mempool.inc.php, poll-log.inc.php, processor-edit.inc.php, processor.inc.php, routing-edit.inc.php, sensors-common.inc.php, storage-edit.inc.php, storage.inc.php, and toner.inc.php (in includes/html/table). NOTE: some sources refer to this as CVE-2020-15876, but CVE-2020-15875 is the only correct CVE ID.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must be remotely authenticated to LibreNMS with normal user privileges. No user interaction is required, and the attack can be performed over the network.
What information could be exposed?
Successful SQL injection through the searchPhrase parameter can allow the attacker to extract all information from the LibreNMS database. The stated impact is confidentiality loss; integrity and availability impacts are not identified.
Which endpoint and components are affected?
The injection is in the searchPhrase parameter of the /ajax_table.php API endpoint. It affects multiple table handlers under includes/html/table, including alert, event log, inventory, interface, memory pool, processor, routing, sensor, storage, and toner-related handlers.
What version should be used to remediate the issue?
The provided references include the comparison from LibreNMS 1.65 to 1.65.1 and the 1.65.1 release. Updating from the affected 1.65 release to 1.65.1 addresses the issue.
Which CVE identifier should be used for tracking?
Use CVE-2020-15875. Although some sources reportedly refer to CVE-2020-15876, the provided information states that CVE-2020-15875 is the only correct identifier.