ZDI-CAN-22339: ZDI-24-113: Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability

Published Feb 9, 2024

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the insertGraphTemplate function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the service account.

Other sources

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2024-23119.

— ZDI

Affected Software

1 affected component

Centreon Centreon

Event History

Feb 9, 2024

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Feb 28, 2025

Advisory Published

via ZDI·03:42 AM

Frequently Asked Questions

What is the severity of ZDI-CAN-22339?

The severity of ZDI-CAN-22339 is critical due to the potential for remote code execution.

How do I fix ZDI-CAN-22339?

To fix ZDI-CAN-22339, ensure that you apply the latest security patches provided by Centreon.

What versions of Centreon are affected by ZDI-CAN-22339?

ZDI-CAN-22339 affects multiple versions of Centreon that have not addressed the vulnerability.

Is authentication required to exploit ZDI-CAN-22339?

Yes, authentication is required to exploit ZDI-CAN-22339.

What type of vulnerability is ZDI-CAN-22339?

ZDI-CAN-22339 is a remote code execution vulnerability.