CVE-2018-19271 Centreon SQL Injection

What is CVE-2018-19271?

CVE-2018-19271 is a high-severity SQL injection vulnerability in Centreon Centreon, published on 14 Nov 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.28) allows SQL Injection via the main.php searchH parameter.

Weakness: CWE-89

Which versions are affected by CVE-2018-19271?

4 open source packages ship an affected version, including centreon/centreon. It affects 1 product.

Products include Centreon Centreon.

How do I fix CVE-2018-19271?

Upgrade centreon/centreon to a fixed version for your release line: 2.8.28 or 18.10.0.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2018-19271 being exploited?

There is no known exploitation of CVE-2018-19271 in the wild and no public exploit code.

Other vulnerabilities in Centreon Centreon

• CVE-2021-37558 SQL injection in n/a Critical 9.8
• CVE-2019-17647 SQL injection in n/a Critical 9.8
• CVE-2018-21024 File upload in n/a Critical 9.8
• CVE-2019-16194 SQL injection in Centreon Critical 9.8
• CVE-2018-19281 Centreon allows SNMP trap SQL Injection Critical 9.8

All Centreon Centreon vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-79hg-357g-rrgv.