CVE-2015-1561 Centreon Command Injection
MediumCVSS 6.5
EPSS 8.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The escape_command function in include/Administration/corePerformance/getStats.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in Centreon 19.10.0) uses an incorrect regular expression, which allows remote authenticated users to execute arbitrary commands via shell metacharacters in the ns_id parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| centreon/centreon(Packagist) | < 2.8.28 | 2.8.28 |
| centreon/centreon | <= 2.5.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- forge.centreon.com
- github.com product
- web.archive.org
- packetstormsecurity.com exploit
- github.com
- 20150708 Merethis Centreon - Unauthenticated blind SQLi and Authenticated Remote Command Execution mailing-list
- github.com