CVE-2020-15876: SQL Injection
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the sort parameter in the /ajaxtable.php API endpoint. This affects address-search.inc.php, alertlog.inc.php, arp-search.inc.php, as-selection.inc.php, bills.inc.php, devicemibs.inc.php, deviceoids.inc.php, edit-ports.inc.php, eventlog.inc.php, inventory.inc.php, ix-list.inc.php, ix-peers.inc.php, mempool-edit.inc.php, mempool.inc.php, mibs.inc.php, poll-log.inc.php, processor-edit.inc.php, processor.inc.php, routing-edit.inc.php, sensors-common.inc.php, storage-edit.inc.php, storage.inc.php, tnmsneinfo.inc.php, and toner.inc.php (in includes/html/table).
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must be remotely authenticated to LibreNMS with normal privileges. No administrative privileges are stated as necessary.
Which interface and input are involved in exploitation?
The issue is in the sort parameter handled by the /ajax_table.php API endpoint. It affects multiple table handlers under includes/html/table, including alert, event, device, inventory, routing, sensor, storage, and processor-related views.
What is the potential impact if exploitation succeeds?
A successful SQL injection can allow the authenticated attacker to extract all information from the LibreNMS database.
Which LibreNMS version is identified as affected, and is an update available?
LibreNMS 1.65 is identified as affected. The provided references include the 1.65.1 release and a comparison between versions 1.65 and 1.65.1.