CVE-2018-8734 SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter.
CriticalCVSS 9.8
EPSS 53.8%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nagios xi | >= 5.2.0, < 5.4.13 | 5.4.13 |
References
- assets.nagios.com release-notes vendor-advisory
- blog.redactedsec.net exploit technical-description third-party-advisory
- gist.github.com third-party-advisory
- 44560 exploit third-party-advisory vdb-entry
- 44969 exploit third-party-advisory vdb-entry
- www.nagios.com release-notes vendor-advisory