CVE-2018-8734

SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter.

CVSS v3.0 NVD

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

53.76% chance of exploitation in the next 30 days, 99th percentile

Published

2018-04-18

Updated

2024-08-05

Metasploit modules (2)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nagios_xi_chained_rce…
• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nagios_xi_chained_rce…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/44969
• https://www.exploit-db.com/exploits/44560

Security advisories

• https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT
• https://www.nagios.com/downloads/nagios-xi/change-log
• https://blog.redactedsec.net/exploits/2018/04/26/nagios.html
• https://gist.github.com/caleBot/f0a93b5a98574393e0139104eacc2d0f

References

• CVE Record
• NVD entry