SQL Injection Vulnerability in LibreNMS Product by LibreNMS
CVE-2019-12465

8.1HIGH

Key Information:

Vendor

Librenms

Status
Librenms
Vendor
CVE Published:
9 September 2019

What is CVE-2019-12465?

A SQL injection flaw has been identified in the ajax_rulesuggest.php file of LibreNMS version 1.50.1. This vulnerability arises from the insecure handling of the 'term' parameter in a database query, which could allow an attacker to manipulate database queries, leading to unauthorized data access. This can occur during AJAX requests, for instance, through a crafted URL such as ajax_rulesuggest.php?debug=1&term=. It's crucial for users to be aware of this vulnerability to protect their systems against potential exploitation.

References

https://www.darkmatter.ae/xen1thlabs/librenms-sql-injecti...
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.