[Full-disclosure] Nagios XI users.php SQL Injection
- From: Adam Baldwin <adam_baldwin@xxxxxxxxxxxxxxx>
- Date: Tue, 24 Aug 2010 14:53:32 -0700
Nagios XI users.php SQL Injection
Advisory ID: NGENUITY-2010-008
Date published: 8/24/2010
Class: SQL Injection (SQLi)
Nagios XI is the commercial / enterprise version of the open source
Nagios XI prior to version 2009R1.3 is vulnerable to SQL Injection. It
is possible for specially designed queries to extract data via the
database error messages. Authentication and access to users.php is
required. It is possible to also use this SQL injection has a remote XSS
vector as the error message is not properly sanitized.
The records variable on the users.php command is not properly sanitized
and allows for injection of SQL commands. Stacked queries are also
allowed into the postgres database.
password from xi_users where username= >
The password hash of the nagiosadmin user would be displayed in the
error message as a result of this query.
This vulnerability was discovered by Adam Baldwin
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- Prev by Date: [Full-disclosure] ZDI-10-164: Adobe Shockwave Player Director File FFFFFF88 Record Processing Remote Code Execution Vulnerability
- Next by Date: [Full-disclosure] iDefense Security Advisory 08.24.10: Adobe Shockwave Player Memory Corruption Vulnerability
- Previous by thread: [Full-disclosure] ZDI-10-164: Adobe Shockwave Player Director File FFFFFF88 Record Processing Remote Code Execution Vulnerability
- Next by thread: [Full-disclosure] iDefense Security Advisory 08.24.10: Adobe Shockwave Player Memory Corruption Vulnerability