LibreNMS vulnerable to SQL injection in prior versions

CVE-2024-32480

What is CVE-2024-32480?

LibreNMS is an open-source network monitoring system that utilizes PHP, MySQL, and SNMP. A vulnerability exists in versions prior to 24.4.0, where improper handling of the order parameter, derived from $request, allows an attacker to manipulate SQL queries. This occurs because the parameter is directly concatenated within an SQL statement after a basic string check. Successful exploitation of this vulnerability may allow an attacker to access and extract sensitive data from the database. The issue has been resolved in version 24.4.0, making it crucial for users to update their systems.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References