CVE-2024-32480 LibreNMS's Time-Based Blind SQL injection leads to database extraction

What is CVE-2024-32480?

CVE-2024-32480 is a high-severity SQL injection vulnerability in Librenms Librenms, published on 22 Apr 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Versions prior to 24.4.0 are vulnerable to SQL injection. The `order` parameter is obtained from `$request`. After performing a string check, the value is directly incorporated into an SQL statement and concatenated, resulting in a SQL injection vulnerability. An attacker may extract a whole database this way. Version 24.4.0 fixes the issue.

Weakness: CWE-89

Which versions are affected by CVE-2024-32480?

2 open source packages ship an affected version, including librenms/librenms. It affects 1 product.

Products include Librenms Librenms.

How do I fix CVE-2024-32480?

Upgrade librenms/librenms to 24.4.0 or later.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2024-32480 being exploited?

There is no known exploitation of CVE-2024-32480 in the wild and no public exploit code.

Other vulnerabilities in Librenms Librenms

• CVE-2023-4982 Cross-site Scripting (XSS) - Stored in librenms/librenms Critical 9.8
• CVE-2022-29712 Command injection in librenms Critical 9.8
• CVE-2021-44278 Path traversal in librenms/librenms Critical 9.8
• CVE-2019-10665 LibreNMS Information Disclosure Critical 9.8
• CVE-2018-20434 LibreNMS arbitrary OS commands execution Critical 9.8

All Librenms Librenms vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jh57-j3vq-h438.