CVE-2018-19312 Centreon SQL Injection

What is CVE-2018-19312?

CVE-2018-19312 is a high-severity SQL injection vulnerability in Centreon Centreon, published on 16 Nov 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.24) allows SQL Injection via the searchVM parameter to the main.php?p=20408 URI.

Weakness: CWE-89

Which versions are affected by CVE-2018-19312?

4 open source packages ship an affected version, including centreon/centreon. It affects 1 product.

Products include Centreon Centreon.

How do I fix CVE-2018-19312?

Upgrade centreon/centreon to a fixed version for your release line: 18.10.0 or 2.8.24.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2018-19312 being exploited?

There is no known exploitation of CVE-2018-19312 in the wild and no public exploit code.

Other vulnerabilities in Centreon Centreon

• CVE-2021-37558 SQL injection in n/a Critical 9.8
• CVE-2019-17647 SQL injection in n/a Critical 9.8
• CVE-2018-21024 File upload in n/a Critical 9.8
• CVE-2019-16194 SQL injection in Centreon Critical 9.8
• CVE-2018-19281 Centreon allows SNMP trap SQL Injection Critical 9.8

All Centreon Centreon vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5jxp-4x68-mhqc.