CVE-2014-3828

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

72.71%

Published

Oct 22, 2014

Modified

May 6, 2026

Public PoC / Exploit (3)

All weaponized →

Exploit-DBCentreon < 2.5.1 / Centreon Enterprise Server < 2.2 - SQL Injection / Command Injection (Metasploit)Exploit-DBCentreon - SQL Injection / Command Injection (Metasploit)TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allow remote attackers to execute arbitrary SQL commands via (1) the index_id parameter to views/graphs/common/makeXML_ListMetrics.php, (2) the sid parameter to views/graphs/GetXmlTree.php, (3) the session_id parameter to views/graphs/graphStatus/displayServiceStatus.php, (4) the mnftr_id parameter to configuration/configObject/traps/GetXMLTrapsForVendor.php, or (5) the index parameter to common/javascript/commandGetArgs/cmdGetExample.php in include/.

Weaknesses (CWE)

CWE-89

Affected Products (2)

merethis · centreonvulnerable

merethis · centreon_enterprise_servervulnerable

References (10)

http://seclists.org/fulldisclosure/2014/Oct/78

Exploit

http://www.kb.cert.org/vuls/id/298796

Third Party AdvisoryUS Government Resource

http://www.securityfocus.com/bid/70648

Exploit